Page MenuHomeFreeBSD

miibus: Use a bus_child_deleted method to free ivars for children
ClosedPublic

Authored by jhb on Oct 31 2024, 8:36 PM.
Tags
None
Referenced Files
Unknown Object (File)
Tue, Dec 10, 11:39 AM
Unknown Object (File)
Mon, Dec 9, 6:27 AM
Unknown Object (File)
Nov 22 2024, 4:16 PM
Unknown Object (File)
Nov 21 2024, 9:09 PM
Unknown Object (File)
Nov 21 2024, 6:18 PM
Unknown Object (File)
Nov 16 2024, 6:37 PM
Unknown Object (File)
Nov 2 2024, 7:20 AM
Unknown Object (File)
Nov 1 2024, 5:46 PM
Subscribers
None

Details

Summary

If a device was detached (e.g. via devctl) and then re-attached, the
ivars would be freed by the previous bus_child_detached method during
detach, but device_get_ivars during the subsequent attach would return
a stale pointer resulting in a use after free.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable