svn commit: r348398 - head/sys/dev/ena

[Marcin Wojtas]

Author: mw
Date: Thu May 30 13:22:53 2019
New Revision: 348398
URL: https://svnweb.freebsd.org/changeset/base/348398

Log:
  Change order of ifp release on ENA detach
  
  In rare case, when the ifconfig is called just before kldunload, it is
  possible, that ena_up routine will be called after queue locks are
  released.
  
  To prevent that, ifp is detached before the last ena_down is called and
  further, the ifp is freed at the end of the function.
  
  Submitted by:  Michal Krawczyk <mk at semihalf.com>
  Obtained from: Semihalf
  Sponsored by:  Amazon, Inc.

Modified:
  head/sys/dev/ena/ena.c

Modified: head/sys/dev/ena/ena.c
==============================================================================
--- head/sys/dev/ena/ena.c	Thu May 30 13:22:12 2019	(r348397)
+++ head/sys/dev/ena/ena.c	Thu May 30 13:22:53 2019	(r348398)
@@ -3893,6 +3893,8 @@ ena_detach(device_t pdev)
 		return (EBUSY);
 	}
 
+	ether_ifdetach(adapter->ifp);
+
 	/* Free reset task and callout */
 	callout_drain(&adapter->timer_service);
 	while (taskqueue_cancel(adapter->reset_tq, &adapter->reset_task, NULL))
@@ -3903,11 +3905,6 @@ ena_detach(device_t pdev)
 	ena_down(adapter);
 	sx_unlock(&adapter->ioctl_sx);
 
-	if (adapter->ifp != NULL) {
-		ether_ifdetach(adapter->ifp);
-		if_free(adapter->ifp);
-	}
-
 	ena_free_all_io_rings_resources(adapter);
 
 	ena_free_counters((counter_u64_t *)&adapter->hw_stats,
@@ -3948,6 +3945,8 @@ ena_detach(device_t pdev)
 
 	mtx_destroy(&adapter->global_mtx);
 	sx_destroy(&adapter->ioctl_sx);
+
+	if_free(adapter->ifp);
 
 	if (ena_dev->bus != NULL)
 		free(ena_dev->bus, M_DEVBUF);