The branch stable/15 has been updated by christos: URL: https://cgit.FreeBSD.org/src/commit/?id=de60db7469f057748435281d147143f3c8b35474
commit de60db7469f057748435281d147143f3c8b35474 Author: Xuqing Yang <[email protected]> AuthorDate: 2026-08-18 20:17:44 +0000 Commit: Christos Margiolis <[email protected]> CommitDate: 2026-09-02 09:38:58 +0000 bcm2835_audio: Comment out vchi_service_release() bcm2835_audio_release() calls vchi_service_close() and then unconditionally calls vchi_service_release() with the same service handle. In the VCHI shim implementation, a successful vchi_service_close() calls service_free(service). The subsequent vchi_service_release() therefore dereferences a freed SHIM_SERVICE_T object when it reads service->handle, resulting in a use-after-free panic. vchi_service_release(), however, releases a reference which might block vchi_service_close() from completing successfuly, so comment it out instead of removing it altogether, until further testing is done. PR: 297187 MFC after: 2 weeks Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D58921 (cherry picked from commit 95c04b25323d59da43203a08e56db141ac37181b) --- sys/arm/broadcom/bcm2835/bcm2835_audio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/arm/broadcom/bcm2835/bcm2835_audio.c b/sys/arm/broadcom/bcm2835/bcm2835_audio.c index 0915bee677ef..8355fa62d21e 100644 --- a/sys/arm/broadcom/bcm2835/bcm2835_audio.c +++ b/sys/arm/broadcom/bcm2835/bcm2835_audio.c @@ -295,10 +295,10 @@ bcm2835_audio_release(struct bcm2835_audio_info *sc) int success; if (sc->vchi_handle != VCHIQ_SERVICE_HANDLE_INVALID) { + /* XXX vchi_service_release(sc->vchi_handle)? */ success = vchi_service_close(sc->vchi_handle); if (success != 0) printf("vchi_service_close failed: %d\n", success); - vchi_service_release(sc->vchi_handle); sc->vchi_handle = VCHIQ_SERVICE_HANDLE_INVALID; }
