svn commit: r304133 - stable/11/sys/dev/mlx5/mlx5_en

[Hans Petter Selasky]

Author: hselasky
Date: Mon Aug 15 09:07:26 2016
New Revision: 304133
URL: https://svnweb.freebsd.org/changeset/base/304133

Log:
  MFC r303870:
  Fix for use after free.
  
  Clear the device description to avoid use after free because the
  bsddev is not destroyed when the mlx5en module is unloaded. Only when
  the parent mlx5 module is unloaded the bsddev is destroyed. This fixes
  a panic on listing sysctls which refer strings in the bsddev after the
  mlx5en module has been unloaded.
  
  Sponsored by:	Mellanox Technologies

Modified:
  stable/11/sys/dev/mlx5/mlx5_en/mlx5_en_main.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/dev/mlx5/mlx5_en/mlx5_en_main.c
==============================================================================
--- stable/11/sys/dev/mlx5/mlx5_en/mlx5_en_main.c	Mon Aug 15 09:06:33 2016	(r304132)
+++ stable/11/sys/dev/mlx5/mlx5_en/mlx5_en_main.c	Mon Aug 15 09:07:26 2016	(r304133)
@@ -3108,6 +3108,13 @@ mlx5e_destroy_ifp(struct mlx5_core_dev *
 	/* don't allow more IOCTLs */
 	priv->gone = 1;
 
+	/*
+	 * Clear the device description to avoid use after free,
+	 * because the bsddev is not destroyed when this module is
+	 * unloaded:
+	 */
+	device_set_desc(mdev->pdev->dev.bsddev, NULL);
+
 	/* XXX wait a bit to allow IOCTL handlers to complete */
 	pause("W", hz);