Set ifm_cur to NULL in ifmedia_removeall.
ClosedPublic
Actions

Authored by mjoras on Jan 12 2017, 9:09 PM.

Details

Reviewers

erj
sbruno

Group Reviewers

Intel Networking

Commits

rS312544: Fix reference to free memory in ixgbe/if_media.c

Summary

ixgbe will call ifmedia_removeall on a link interrupt so it can refresh
the media types. ifmedia_removeall frees all the entries in the list,
but it does not reset ifm_cur (which is supposed to point to the current
media type) to NULL. As such, after a link interrupt ixgbe's media type
(which is read from ifm_cur) will show up as all sorts of fun things.
Additionally we want to set autoselect as the default after setting the
media types in the link interrupt.

Test Plan

You can see the problem pretty obviously on an INVARIANTS kernel, since the memory
gets overwritten with 0xdeadc0de:

mjoras-006-1# cat media.d 
fbt::ifmedia_ioctl:entry /execname == "ifconfig"/ {printf("%x", ((struct ifmedia_entry *)((struct ifmedia *)args[2])->ifm_cur)->ifm_media);} 
mjoras-006-1# dtrace -s media.d&
[1] 31997
mjoras-006-1# dtrace: script 'media.d' matched 1 probe
mjoras-006-1# ifconfig ix0 down
mjoras-006-1# ifconfig ix0   
ix0: flags=808802<BROADCAST,SIMPLEX,MULTICAST,ISIUSERDOWN> metric 0 mtu 1500
	options=e407bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,TSO4,TSO6,LRO,VLAN_HWTSO,RXCSUM_IPV6,TXCSUM_IPV6>
	ether 00:60:48:3c:3c:60
	nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
	media: Ethernet 10Gbase-SR (autoselect)
	status: no carrier
mjoras-006-1#   5  14589              ifmedia_ioctl:entry 33
  5  14589              ifmedia_ioctl:entry 33
  5  14589              ifmedia_ioctl:entry 33

mjoras-006-1# ifconfig ix0 up
mjoras-006-1# 
mjoras-006-1# ifconfig ix0
ix0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
	options=e407bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,TSO4,TSO6,LRO,VLAN_HWTSO,RXCSUM_IPV6,TXCSUM_IPV6>
	ether 00:60:48:3c:3c:60
	nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
	media: <unknown type> (10Gbase-SR <full-duplex,rxpause>)
	status: active
mjoras-006-1#   7  14589              ifmedia_ioctl:entry deadc0de
  7  14589              ifmedia_ioctl:entry deadc0de
  7  14589              ifmedia_ioctl:entry deadc0de