Author: hselasky
Date: Sat Aug 29 06:17:39 2015
New Revision: 287273
URL: https://svnweb.freebsd.org/changeset/base/287273
Log:
MFC r286799:
Fix race in USB PF which can happen if we stop tracing exactly when
the kernel is tapping an USB transfer. This leads to a NULL pointer
access. The solution is to only trace while the USB bus lock is
locked.
Modified:
stable/9/sys/dev/usb/usb_pf.c
stable/9/sys/dev/usb/usb_transfer.c
Directory Properties:
stable/9/sys/ (props changed)
stable/9/sys/dev/ (props changed)
Modified: stable/9/sys/dev/usb/usb_pf.c
==============================================================================
--- stable/9/sys/dev/usb/usb_pf.c Sat Aug 29 06:11:50 2015
(r287272)
+++ stable/9/sys/dev/usb/usb_pf.c Sat Aug 29 06:17:39 2015
(r287273)
@@ -103,13 +103,16 @@ usbpf_detach(struct usb_bus *ubus)
{
struct ifnet *ifp = ubus->ifp;
+ USB_BUS_LOCK(ubus);
+ ubus->ifp = NULL;
+ USB_BUS_UNLOCK(ubus);
+
if (ifp != NULL) {
bpfdetach(ifp);
if_down(ifp);
if_detach(ifp);
if_free(ifp);
}
- ubus->ifp = NULL;
}
static uint32_t
Modified: stable/9/sys/dev/usb/usb_transfer.c
==============================================================================
--- stable/9/sys/dev/usb/usb_transfer.c Sat Aug 29 06:11:50 2015
(r287272)
+++ stable/9/sys/dev/usb/usb_transfer.c Sat Aug 29 06:17:39 2015
(r287273)
@@ -2292,8 +2292,11 @@ usbd_callback_wrapper(struct usb_xfer_qu
}
#if USB_HAVE_PF
- if (xfer->usb_state != USB_ST_SETUP)
+ if (xfer->usb_state != USB_ST_SETUP) {
+ USB_BUS_LOCK(info->bus);
usbpf_xfertap(xfer, USBPF_XFERTAP_DONE);
+ USB_BUS_UNLOCK(info->bus);
+ }
#endif
/* call processing routine */
(xfer->callback) (xfer, xfer->error);
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-stable-9
To unsubscribe, send any mail to "[email protected]"
