From nobody Tue Aug 18 20:18:53 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hPgyP74Kdz6nncy for ; Tue, 18 Aug 2026 20:18:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hPgyP6MfBz3Wjw for ; Tue, 18 Aug 2026 20:18:53 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787084333; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=s22z8reiZnejJytT/UGuk7qox4Stjuel+F08MyiojXo=; b=uBdEe+rmhvhOPSLi2II8+5Da7JwdZDy07WgM4D9Jh7loQdqYADQQCGooZniq8kkVV6dzSI RwIgE3D91yeMMDwLaLnc3FbUvEwgFHm/WuKNIW+gNkaI0T9T/K+bnF/mFi//w35Kf6B0yu 3E1kjMF+uCd/Q0lKVEXF6ApKcNgHIO8g2yP7acP7eCDtKe/X9mGLePGSvHecTzWk9lo6mx VFhHn6snTBex7TgKkaRyeee1HCMn23VjNFnC1xvzeWG1WWVun/9hkz93waCa/5Qt+fOInd g4uSTJdINLKJWqcUoypjxDIq5eZcJDapFcQWq/9Ruf8RLh+xVb7vNdbYOxIFyg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787084333; a=rsa-sha256; cv=none; b=XbEuZw9W4ttB7GaGCVUW2SVCEQRYQEJ7eASFuKvGY9w+HneGCfH/LJAQOruQwjyhPmNnQ8 NNJycwNWpXI//EJz3HzuPwFdiFUb0AGkTrb4tDNTy9e/Hz1ewzkNj37TtaFlWghzW+ytc/ cstCqQViqyUwmf6mWp3ubuOCUSzfmiPkXntuAJ/44vNmg96m+3Y9NGZ8qlxZRsdY3IjCuw xADuGs0bsDunVTxjGH5F9hr8ZrLfPNQFuEK3wsh5Pl0J3Oyes87nO3I3VgWs/VvPzgjYZq 6CJ8zAMe09eCwBd5OZSwMeNPnTrSY5G8pvUi5vt38RSpjgAox12PSmp2+IDp/A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787084333; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=s22z8reiZnejJytT/UGuk7qox4Stjuel+F08MyiojXo=; b=XUGzBIOPBeC3DlOE+gCghlI1llCKK9jVZPayZpFdMNAEZOkoRhnz6ONjDsXtBKFJdi+lS4 zNg+p1ANlH/dGRsUTMQwN83eOzHd59D4T0XMtZHCH0XTd077b+xBo7VxD62mS9dDVCoHBM svQNPjXPuFceQO52AGY2brKuDjkJVuJFB59y5sTcDqoT92QL97LsB1oKsNBgETAmWIica5 skSSLn/AKtrKdIMQpDpiWUO+x/2/rcSXeDhKB59rjZPuWvbjUgRej2OqcEJQIXR3rkc6CO 1PcEIwZaRmFPjAzwzfoCMxur9vRKHnHjd9CyK3Zi23Il+dL12K9NUKgQ1SV+Vg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hPgyP51xKz100j for ; Tue, 18 Aug 2026 20:18:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 20f36 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 18 Aug 2026 20:18:53 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: Xuqing Yang From: Christos Margiolis Subject: git: 95c04b25323d - main - bcm2835_audio: Comment out vchi_service_release() List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: christos X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 95c04b25323d59da43203a08e56db141ac37181b Auto-Submitted: auto-generated Date: Tue, 18 Aug 2026 20:18:53 +0000 Message-Id: <6a84be2d.20f36.1abaf315@gitrepo.freebsd.org> The branch main has been updated by christos: URL: https://cgit.FreeBSD.org/src/commit/?id=95c04b25323d59da43203a08e56db141ac37181b commit 95c04b25323d59da43203a08e56db141ac37181b Author: Xuqing Yang AuthorDate: 2026-08-18 20:17:44 +0000 Commit: Christos Margiolis CommitDate: 2026-08-18 20:18:01 +0000 bcm2835_audio: Comment out vchi_service_release() bcm2835_audio_release() calls vchi_service_close() and then unconditionally calls vchi_service_release() with the same service handle. In the VCHI shim implementation, a successful vchi_service_close() calls service_free(service). The subsequent vchi_service_release() therefore dereferences a freed SHIM_SERVICE_T object when it reads service->handle, resulting in a use-after-free panic. vchi_service_release(), however, releases a reference which might block vchi_service_close() from completing successfuly, so comment it out instead of removing it altogether, until further testing is done. PR: 297187 MFC after: 2 weeks Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D58921 --- sys/arm/broadcom/bcm2835/bcm2835_audio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/arm/broadcom/bcm2835/bcm2835_audio.c b/sys/arm/broadcom/bcm2835/bcm2835_audio.c index 1406fcc3d952..29808b053b92 100644 --- a/sys/arm/broadcom/bcm2835/bcm2835_audio.c +++ b/sys/arm/broadcom/bcm2835/bcm2835_audio.c @@ -360,11 +360,11 @@ bcm2835_audio_release(struct bcm2835_audio_info *sc) int success; if (sc->vchi_handle != VCHIQ_SERVICE_HANDLE_INVALID) { + /* XXX vchi_service_release(sc->vchi_handle)? */ success = vchi_service_close(sc->vchi_handle); if (success != 0) BCM2835_LOG_ERROR(sc, "vchi_service_close failed: %d\n", success); - vchi_service_release(sc->vchi_handle); sc->vchi_handle = VCHIQ_SERVICE_HANDLE_INVALID; }