From be5c2cd0139c4c1a41978d266b1c6b39a2e5b91a Mon Sep 17 00:00:00 2001 From: hselasky Date: Thu, 3 Jul 2014 13:49:43 +0000 Subject: [PATCH] MFC r268078 and r268080: Fix for memory use after free() and mtx_destroy(). Approved by: re, glebius @ git-svn-id: svn://svn.freebsd.org/base/releng/9.3@268214 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f --- sys/dev/usb/net/uhso.c | 7 ++----- sys/dev/usb/serial/usb_serial.c | 2 +- sys/dev/usb/serial/usb_serial.h | 2 +- 3 files changed, 4 insertions(+), 7 deletions(-) diff --git a/sys/dev/usb/net/uhso.c b/sys/dev/usb/net/uhso.c index 1c1149043..476a58587 100644 --- a/sys/dev/usb/net/uhso.c +++ b/sys/dev/usb/net/uhso.c @@ -558,8 +558,6 @@ uhso_attach(device_t self) mtx_init(&sc->sc_mtx, "uhso", NULL, MTX_DEF); ucom_ref(&sc->sc_super_ucom); - sc->sc_ucom = NULL; - sc->sc_ttys = 0; sc->sc_radio = 1; id = usbd_get_interface_descriptor(uaa->iface); @@ -679,9 +677,6 @@ uhso_detach(device_t self) UHSO_CTRL_MAX); } } - - free(sc->sc_tty, M_USBDEV); - free(sc->sc_ucom, M_USBDEV); } if (sc->sc_ifp != NULL) { @@ -709,6 +704,8 @@ static void uhso_free_softc(struct uhso_softc *sc) { if (ucom_unref(&sc->sc_super_ucom)) { + free(sc->sc_tty, M_USBDEV); + free(sc->sc_ucom, M_USBDEV); mtx_destroy(&sc->sc_mtx); device_free_softc(sc); } diff --git a/sys/dev/usb/serial/usb_serial.c b/sys/dev/usb/serial/usb_serial.c index 2945415bb..a34f684c4 100644 --- a/sys/dev/usb/serial/usb_serial.c +++ b/sys/dev/usb/serial/usb_serial.c @@ -203,7 +203,7 @@ ucom_uninit(void *arg) mtx_destroy(&ucom_mtx); } -SYSUNINIT(ucom_uninit, SI_SUB_KLD - 2, SI_ORDER_ANY, ucom_uninit, NULL); +SYSUNINIT(ucom_uninit, SI_SUB_KLD - 3, SI_ORDER_ANY, ucom_uninit, NULL); /* * Mark a unit number (the X in cuaUX) as in use. diff --git a/sys/dev/usb/serial/usb_serial.h b/sys/dev/usb/serial/usb_serial.h index 5c6e71c9d..8fdf988ca 100644 --- a/sys/dev/usb/serial/usb_serial.h +++ b/sys/dev/usb/serial/usb_serial.h @@ -195,7 +195,7 @@ struct ucom_softc { #define UCOM_MTX_LOCK(sc) mtx_lock((sc)->sc_mtx) #define UCOM_MTX_UNLOCK(sc) mtx_unlock((sc)->sc_mtx) #define UCOM_UNLOAD_DRAIN(x) \ -SYSUNINIT(var, SI_SUB_KLD - 3, SI_ORDER_ANY, ucom_drain_all, 0) +SYSUNINIT(var, SI_SUB_KLD - 2, SI_ORDER_ANY, ucom_drain_all, 0) #define ucom_cfg_do_request(udev,com,req,ptr,flags,timo) \ usbd_do_request_proc(udev,&(com)->sc_super->sc_tq,req,ptr,flags,NULL,timo) -- 2.42.0