Page MenuHomeFreeBSD

miibus: Use a bus_child_deleted method to free ivars for children
ClosedPublic

Authored by jhb on Oct 31 2024, 8:36 PM.
Tags
None
Referenced Files
F153261053: D47371.id145845.diff
Mon, Apr 20, 3:07 AM
Unknown Object (File)
Fri, Apr 17, 2:15 AM
Unknown Object (File)
Thu, Apr 16, 6:47 PM
Unknown Object (File)
Thu, Apr 16, 12:12 PM
Unknown Object (File)
Thu, Apr 9, 8:25 PM
Unknown Object (File)
Wed, Apr 8, 11:17 PM
Unknown Object (File)
Sun, Apr 5, 6:25 AM
Unknown Object (File)
Sun, Mar 22, 5:17 PM
Subscribers
None

Details

Summary

If a device was detached (e.g. via devctl) and then re-attached, the
ivars would be freed by the previous bus_child_detached method during
detach, but device_get_ivars during the subsequent attach would return
a stale pointer resulting in a use after free.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable