Page MenuHomeFreeBSD

iflib: fix dangling device softc pointer
ClosedPublic

Authored by jacob.e.keller_intel.com on Jul 19 2019, 10:44 PM.
Tags
None
Referenced Files
F159734660: D21003.id59949.diff
Wed, Jun 17, 4:07 PM
F159734656: D21003.id59949.diff
Wed, Jun 17, 4:07 PM
F159728592: D21003.id59949.diff
Wed, Jun 17, 2:19 PM
Unknown Object (File)
Sat, Jun 6, 1:41 PM
Unknown Object (File)
Thu, Jun 4, 6:26 AM
Unknown Object (File)
May 17 2026, 5:14 PM
Unknown Object (File)
May 17 2026, 5:07 PM
Unknown Object (File)
May 17 2026, 9:29 AM
Subscribers

Details

Summary

If a driver's IFDI_ATTACH_PRE function fails, the iflib_device_register
function will free the ctx pointer. However, it does not reset the
device softc pointer to NULL.

This will result in memory corruption as a future access to the now
invalid pointer will corrupt memory that is later allocated on top of
the same memory location.

The iflib_device_deregister function correctly resets the softc pointer
by using device_set_softc().

This clears up the invalid dangling pointer and prevents memory
corruption that could lead to a panic or undefined behavior if the
device's driver failed to attach.

Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>

Test Plan

This fixes memory corruption that can lead to system instability and panics
if a device driver fails to attach. Ideally we should backport this into
both STABLE-11 and STABLE-12

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

This revision is now accepted and ready to land.Jul 24 2019, 8:48 PM
This revision was automatically updated to reflect the committed changes.