Fix double-free bug within ena_detach()
authorMarcin Wojtas <mw@FreeBSD.org>
Tue, 26 May 2020 16:02:10 +0000 (16:02 +0000)
committerMarcin Wojtas <mw@FreeBSD.org>
Tue, 26 May 2020 16:02:10 +0000 (16:02 +0000)
commit9bf7da95171833e01b97f197a737f42a352e0e99
tree02f39dbda07ba75a99705a6b511c42cd06b2f648
parent0b432b702ef4ffffab771cf344ed9dd45a68550b
Fix double-free bug within ena_detach()

There is ena_free_all_io_rings_resources() called twice on device
detach:

ena_detach():

ena_destroy_device():
/* First call */
ena_free_all_io_rings_resources()

/* Second call */
ena_free_all_io_rings_resources()

The double-free causes panic() on kldunload, for example.

As the ena_destroy_device() is also called by ena_reset_task() it is
better to stay unchanged. Thus, remove the "Second call" of the function.

Submitted by:  Maciej Bielski <mba@semihalf.com>
Obtained from: Semihalf
Sponsored by:  Amazon, Inc.
sys/dev/ena/ena.c