From 9e85b9ea2aafd63d3270d4029d04b4336885a5b6 Mon Sep 17 00:00:00 2001 From: Augustin Cavalier Date: Sat, 14 May 2022 11:40:05 -0400 Subject: [PATCH] network/stack: Return immediately from device_reader_thread after calling device_removed. Otherwise we can and will use-after-free the device structures. It seems this code has been broken this way since it was first added in cc8eceb0af9ece5bcea51b106fa73e83b6b750a8 (2010). --- src/add-ons/kernel/network/stack/device_interfaces.cpp | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/add-ons/kernel/network/stack/device_interfaces.cpp b/src/add-ons/kernel/network/stack/device_interfaces.cpp index b3c7a42187..dd741c1106 100644 --- a/src/add-ons/kernel/network/stack/device_interfaces.cpp +++ b/src/add-ons/kernel/network/stack/device_interfaces.cpp @@ -42,7 +42,7 @@ static uint32 sDeviceIndex; /*! A service thread for each device interface. It just reads as many packets - as availabe, deframes them, and puts them into the receive queue of the + as available, deframes them, and puts them into the receive queue of the device interface. */ static status_t @@ -69,7 +69,8 @@ device_reader_thread(void* _interface) fifo_enqueue_buffer(&interface->receive_queue, buffer); } else if (status == B_DEVICE_NOT_FOUND) { - device_removed(device); + device_removed(device); + return status; } else { // In case of error, give the other threads some // time to run since this is a high priority time thread.