mirror of
https://github.com/opnsense/src.git
synced 2026-04-15 14:29:58 -04:00
When ena_detach is called, we first call ether_ifdetach(),
which destroys internal addresses of ifp. One such address
is ifp->if_addr->ifa_addr. Then during ena_destroy_device(),
if_link_state_change() is called, eventually trying to access
ifp->if_addr->ifa_addr->sa_family. This causes an access
to garbage memory and crashes the kernel.
Ticket [1] was opened to the FreeBSD community to add null
check in the code of if_link_state_change().
A fix was submitted in commit [2], however it was noted
that it is our driver's responsibilty to not call
if_link_state_change() after calling ether_ifdetach().
This commit makes sure if_link_state_change() is not called
after ether_ifdetach().
[1]: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=270813
[2]: https://reviews.freebsd.org/D39614
Fixes:
|
||
|---|---|---|
| .. | ||
| ena.c | ||
| ena.h | ||
| ena_datapath.c | ||
| ena_datapath.h | ||
| ena_netmap.c | ||
| ena_netmap.h | ||
| ena_rss.c | ||
| ena_rss.h | ||
| ena_sysctl.c | ||
| ena_sysctl.h | ||