Page MenuHomeFreeBSD

ena: Fix driver unload crash
Needs ReviewPublic

Authored by akiyano_amazon.com on Jun 27 2023, 8:32 AM.
Tags
None
Referenced Files
F81735937: D40766.diff
Sat, Apr 20, 4:18 PM
Unknown Object (File)
Sun, Apr 14, 8:47 PM
Unknown Object (File)
Sun, Apr 7, 11:11 PM
Unknown Object (File)
Wed, Apr 3, 3:45 PM
Unknown Object (File)
Mon, Apr 1, 1:45 AM
Unknown Object (File)
Fri, Mar 29, 9:22 AM
Unknown Object (File)
Tue, Mar 26, 2:23 AM
Unknown Object (File)
Mar 21 2024, 4:42 AM
Subscribers

Details

Reviewers
mw
Summary

When ena_detach is called, we first call ether_ifdetach(),
which destroys internal addresses of ifp. One such address
is ifp->if_addr->ifa_addr. Then during ena_destroy_device(),
if_link_state_change() is called, eventually trying to access
ifp->if_addr->ifa_addr->sa_family. This causes an access
to garbage memory and crashes the kernel.

Ticket [1] was opened to the FreeBSD community to add null
check in the code of if_link_state_change().
A fix was submitted in commit [2], however it was noted
that it is our driver's responsibilty to not call
if_link_state_change() after calling ether_ifdetach().

This commit makes sure if_link_state_change() is not called
after ether_ifdetach().

[1]: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=270813
[2]: https://reviews.freebsd.org/D39614

Fixes: 32f63fa7f975 ("Split ENA reset routine into restore and destroy stages")
MFC after: 2 weeks
Sponsored by: Amazon, Inc.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped