Re: svn commit: r307518 - in head/sys: arm/allwinner arm/at91 arm/cavium/cns11xx arm/samsung/exynos arm/ti/am335x arm/ti/usb arm/xilinx boot/kshim dev/bhnd/cores/usb dev/puc dev/usb dev/usb/controller

[John Baldwin]

On Monday, October 17, 2016 10:20:39 AM Hans Petter Selasky wrote:
> Author: hselasky
> Date: Mon Oct 17 10:20:38 2016
> New Revision: 307518
> URL: https://svnweb.freebsd.org/changeset/base/307518
> 
> Log:
>   Fix device delete child function.
>   
>   When detaching device trees parent devices must be detached prior to
>   detaching its children. This is because parent devices can have
>   pointers to the child devices in their softcs which are not
>   invalidated by device_delete_child(). This can cause use after free
>   issues and panic().
>   
>   Device drivers implementing trees, must ensure its detach function
>   detaches or deletes all its children before returning.
>   
>   While at it remove now redundant device_detach() calls before
>   device_delete_child() and device_delete_children(), mostly in
>   the USB controller drivers.
>   
>   Tested by:  Jan Henrik Sylvester 
>   Reviewed by:jhb
>   Differential Revision:  https://reviews.freebsd.org/D8070
>   MFC after:  2 weeks

Thanks.

-- 
John Baldwin
___
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"

svn commit: r307518 - in head/sys: arm/allwinner arm/at91 arm/cavium/cns11xx arm/samsung/exynos arm/ti/am335x arm/ti/usb arm/xilinx boot/kshim dev/bhnd/cores/usb dev/puc dev/usb dev/usb/controller ...

[Hans Petter Selasky]

Author: hselasky
Date: Mon Oct 17 10:20:38 2016
New Revision: 307518
URL: https://svnweb.freebsd.org/changeset/base/307518

Log:
  Fix device delete child function.
  
  When detaching device trees parent devices must be detached prior to
  detaching its children. This is because parent devices can have
  pointers to the child devices in their softcs which are not
  invalidated by device_delete_child(). This can cause use after free
  issues and panic().
  
  Device drivers implementing trees, must ensure its detach function
  detaches or deletes all its children before returning.
  
  While at it remove now redundant device_detach() calls before
  device_delete_child() and device_delete_children(), mostly in
  the USB controller drivers.
  
  Tested by:Jan Henrik Sylvester 
  Reviewed by:  jhb
  Differential Revision:https://reviews.freebsd.org/D8070
  MFC after:2 weeks

Modified:
  head/sys/arm/allwinner/a10_ehci.c
  head/sys/arm/at91/at91_ohci.c
  head/sys/arm/at91/at91_ohci_fdt.c
  head/sys/arm/cavium/cns11xx/ehci_ebus.c
  head/sys/arm/cavium/cns11xx/ohci_ec.c
  head/sys/arm/samsung/exynos/exynos5_xhci.c
  head/sys/arm/ti/am335x/am335x_musb.c
  head/sys/arm/ti/usb/omap_ehci.c
  head/sys/arm/xilinx/zy7_ehci.c
  head/sys/boot/kshim/bsd_kernel.c
  head/sys/dev/bhnd/cores/usb/bhnd_ehci.c
  head/sys/dev/bhnd/cores/usb/bhnd_ohci.c
  head/sys/dev/puc/puc.c
  head/sys/dev/usb/controller/at91dci_atmelarm.c
  head/sys/dev/usb/controller/at91dci_fdt.c
  head/sys/dev/usb/controller/atmegadci_atmelarm.c
  head/sys/dev/usb/controller/dwc_otg_fdt.c
  head/sys/dev/usb/controller/ehci_ixp4xx.c
  head/sys/dev/usb/controller/ehci_mv.c
  head/sys/dev/usb/controller/ehci_pci.c
  head/sys/dev/usb/controller/generic_ehci.c
  head/sys/dev/usb/controller/generic_ohci.c
  head/sys/dev/usb/controller/musb_otg_atmelarm.c
  head/sys/dev/usb/controller/ohci_pci.c
  head/sys/dev/usb/controller/ohci_s3c24x0.c
  head/sys/dev/usb/controller/saf1761_otg_boot.c
  head/sys/dev/usb/controller/saf1761_otg_fdt.c
  head/sys/dev/usb/controller/uhci_pci.c
  head/sys/dev/usb/controller/uss820dci_atmelarm.c
  head/sys/dev/usb/controller/xhci_mv.c
  head/sys/dev/usb/controller/xhci_pci.c
  head/sys/dev/usb/usb_device.c
  head/sys/dev/usb/video/udl.c
  head/sys/kern/subr_bus.c
  head/sys/mips/atheros/ar71xx_ehci.c
  head/sys/mips/atheros/ar71xx_ohci.c
  head/sys/mips/cavium/usb/octusb_octeon.c
  head/sys/mips/mediatek/mtk_dotg.c
  head/sys/mips/mediatek/mtk_ehci.c
  head/sys/mips/mediatek/mtk_ohci.c
  head/sys/mips/mediatek/mtk_xhci.c
  head/sys/mips/rmi/xls_ehci.c
  head/sys/mips/rt305x/rt305x_dotg.c
  head/sys/mips/rt305x/rt305x_ehci.c
  head/sys/mips/rt305x/rt305x_ohci.c

Modified: head/sys/arm/allwinner/a10_ehci.c
==
--- head/sys/arm/allwinner/a10_ehci.c   Mon Oct 17 09:40:18 2016
(r307517)
+++ head/sys/arm/allwinner/a10_ehci.c   Mon Oct 17 10:20:38 2016
(r307518)
@@ -275,17 +275,11 @@ a10_ehci_detach(device_t self)
struct aw_ehci_softc *aw_sc = device_get_softc(self);
ehci_softc_t *sc = _sc->sc;
const struct aw_ehci_conf *conf;
-   device_t bdev;
int err;
uint32_t reg_value = 0;
 
conf = USB_CONF(self);
 
-   if (sc->sc_bus.bdev) {
-   bdev = sc->sc_bus.bdev;
-   device_detach(bdev);
-   device_delete_child(self, bdev);
-   }
/* during module unload there are lots of children leftover */
device_delete_children(self);
 

Modified: head/sys/arm/at91/at91_ohci.c
==
--- head/sys/arm/at91/at91_ohci.c   Mon Oct 17 09:40:18 2016
(r307517)
+++ head/sys/arm/at91/at91_ohci.c   Mon Oct 17 10:20:38 2016
(r307518)
@@ -165,14 +165,8 @@ static int
 ohci_atmelarm_detach(device_t dev)
 {
struct at91_ohci_softc *sc = device_get_softc(dev);
-   device_t bdev;
int err;
 
-   if (sc->sc_ohci.sc_bus.bdev) {
-   bdev = sc->sc_ohci.sc_bus.bdev;
-   device_detach(bdev);
-   device_delete_child(dev, bdev);
-   }
/* during module unload there are lots of children leftover */
device_delete_children(dev);
 

Modified: head/sys/arm/at91/at91_ohci_fdt.c
==
--- head/sys/arm/at91/at91_ohci_fdt.c   Mon Oct 17 09:40:18 2016
(r307517)
+++ head/sys/arm/at91/at91_ohci_fdt.c   Mon Oct 17 10:20:38 2016
(r307518)
@@ -171,14 +171,8 @@ static int
 ohci_at91_fdt_detach(device_t dev)
 {
struct at91_ohci_softc *sc = device_get_softc(dev);
-   device_t bdev;
int err;
 
-   if (sc->sc_ohci.sc_bus.bdev) {
-   bdev = sc->sc_ohci.sc_bus.bdev;
-   device_detach(bdev);
-   device_delete_child(dev, bdev);
-   }