⬢ DragonFlyBSD Kernel Audit
DF-4114 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/netif/nge/if_nge.c
+++ b/sys/dev/netif/nge/if_nge.c
@@ -938,7 +938,14 @@
 		ether_ifdetach(ifp);
 	}
 
-	if (sc->nge_miibus)
+	/*
+	 * In TBI mode nge_attach() sets sc->nge_miibus = dev (self
+	 * reference, if_nge.c:864).  device_delete_child(dev, dev) would
+	 * recurse into device_detach(dev)/nge_detach() (state is still
+	 * DS_ATTACHED during detach) or, from the attach-fail path, free
+	 * the live device via kobj_delete().  Never delete ourselves.
+	 */
+	if (sc->nge_miibus && sc->nge_miibus != dev)
 		device_delete_child(dev, sc->nge_miibus);
 	bus_generic_detach(dev);