[Bug 252608] [panic] [usb] [if_ure] Kernel fault on ure disconnect
bugzilla-noreply at freebsd.org
bugzilla-noreply at freebsd.org
Tue Jan 12 17:17:21 UTC 2021
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=252608
--- Comment #7 from Ali Abdallah <ali.abdallah at suse.com> ---
It crashes as well with the patch from comment 5
--- trap 0xc, rip = 0xffffffff803b28f1, rsp = 0xfffffe00c83604c0, rbp =
0xfffffe00c8360540 ---
__mtx_lock_sleep() at __mtx_lock_sleep+0xd1/frame 0xfffffe00c8360540
usbd_do_request_flags() at usbd_do_request_flags+0x740/frame 0xfffffe00c83605d0
usbd_do_request_proc() at usbd_do_request_proc+0x60/frame 0xfffffe00c8360630
ure_miibus_readreg() at ure_miibus_readreg+0x11c/frame 0xfffffe00c83606a0
rgephy_status() at rgephy_status+0x80/frame 0xfffffe00c83606f0
rgephy_service() at rgephy_service+0x417/frame 0xfffffe00c8360750
mii_pollstat() at mii_pollstat+0x46/frame 0xfffffe00c8360780
ure_ifmedia_sts() at ure_ifmedia_sts+0x41/frame 0xfffffe00c83607b0
ifmedia_ioctl() at ifmedia_ioctl+0x16a/frame 0xfffffe00c83607e0
ifhwioctl() at ifhwioctl+0x2af/frame 0xfffffe00c83608e0
ifioctl() at ifioctl+0x2eb/frame 0xfffffe00c8360990
kern_ioctl() at kern_ioctl+0x26d/frame 0xfffffe00c8360a00
sys_ioctl() at sys_ioctl+0xf2/frame 0xfffffe00c8360ac0
Use after free of the if_ure mutex.
--
You are receiving this mail because:
You are the assignee for the bug.
More information about the freebsd-usb
mailing list