⬢ DragonFlyBSD Kernel Audit
DF-4930 / fixcheck.snippet.c
← back to finding ↓ download raw
/*
 * DF-4930 fix-mechanism check (appended behavior to uafsink):
 *
 * The proposed fix (atphy fix.diff) makes atphy_attach call
 * mii_phy_add_media() unconditionally; with zero capabilities that adds
 * exactly the IFM_NONE fallback entry (mii_physubr.c mii_phy_add_media:
 * "if ((sc->mii_flags & MIIF_NOISOLATE) == 0) ADD(IFM_ETHER|IFM_NONE...)"),
 * so miibus_mediainit's ifmedia_set() finds a match and does not panic,
 * and ifm_cur is non-NULL for later atphy_service() calls.
 *
 * hw.uafsink_fixcheck=1 replays the same sequence WITH the fallback entry.
 */
static int
uafsink_fixcheck(SYSCTL_HANDLER_ARGS)
{
	struct ifmedia ifm2;
	int v = 0, error;

	error = sysctl_handle_opaque(oidp, &v, sizeof(v), req);
	if (error != 0 || req->newptr == NULL)
		return (error);

	kprintf("uafsink-fix: ifmedia_init + IFM_NONE fallback entry (the fixed atphy path)\n");
	ifmedia_init(&ifm2, 0, NULL, NULL);
	ifmedia_add(&ifm2,
	    IFM_MAKEWORD(IFM_ETHER, IFM_NONE, 0, 0), 0, NULL);
	kprintf("uafsink-fix: calling ifmedia_set(IFM_ETHER|IFM_NONE) -- must NOT panic\n");
	ifmedia_set(&ifm2, IFM_ETHER | IFM_NONE);
	kprintf("uafsink-fix: survived; ifm_cur=%p (non-NULL keeps atphy_service safe)\n",
	    ifm2.ifm_cur);
	ifmedia_removeall(&ifm2);
	return (0);
}