Author: mw
Date: Thu May 30 13:22:53 2019
New Revision: 348398
URL: https://svnweb.freebsd.org/changeset/base/348398

Log:
  Change order of ifp release on ENA detach
  
  In rare case, when the ifconfig is called just before kldunload, it is
  possible, that ena_up routine will be called after queue locks are
  released.
  
  To prevent that, ifp is detached before the last ena_down is called and
  further, the ifp is freed at the end of the function.
  
  Submitted by:  Michal Krawczyk <m...@semihalf.com>
  Obtained from: Semihalf
  Sponsored by:  Amazon, Inc.

Modified:
  head/sys/dev/ena/ena.c

Modified: head/sys/dev/ena/ena.c
==============================================================================
--- head/sys/dev/ena/ena.c      Thu May 30 13:22:12 2019        (r348397)
+++ head/sys/dev/ena/ena.c      Thu May 30 13:22:53 2019        (r348398)
@@ -3893,6 +3893,8 @@ ena_detach(device_t pdev)
                return (EBUSY);
        }
 
+       ether_ifdetach(adapter->ifp);
+
        /* Free reset task and callout */
        callout_drain(&adapter->timer_service);
        while (taskqueue_cancel(adapter->reset_tq, &adapter->reset_task, NULL))
@@ -3903,11 +3905,6 @@ ena_detach(device_t pdev)
        ena_down(adapter);
        sx_unlock(&adapter->ioctl_sx);
 
-       if (adapter->ifp != NULL) {
-               ether_ifdetach(adapter->ifp);
-               if_free(adapter->ifp);
-       }
-
        ena_free_all_io_rings_resources(adapter);
 
        ena_free_counters((counter_u64_t *)&adapter->hw_stats,
@@ -3948,6 +3945,8 @@ ena_detach(device_t pdev)
 
        mtx_destroy(&adapter->global_mtx);
        sx_destroy(&adapter->ioctl_sx);
+
+       if_free(adapter->ifp);
 
        if (ena_dev->bus != NULL)
                free(ena_dev->bus, M_DEVBUF);
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"

Reply via email to