Invalidate knote list of uhid(4) after device detach. This prevents

a crash that can happen if a uhid(4) device is detached while kqueue
still holds references to knotes that point to the device.

The invalidation has to be done after vdevgone(). This order ensures
that the file descriptors return an error or EOF when kevent(2) returns
the EOF events.

Crash reported and fix tested by Greg Steuck
OK mpi@

1 files changed, 5 insertions, 1 deletions

diff --git a/sys/dev/usb/uhid.c b/sys/dev/usb/uhid.c
index 9cadd22ad35..979105a069d 100644
--- a/sys/dev/usb/uhid.c
+++ b/sys/dev/usb/uhid.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uhid.c,v 1.75 2019/12/31 13:48:31 visa Exp $ */
+/*	$OpenBSD: uhid.c,v 1.76 2020/01/18 09:00:52 visa Exp $ */
 /*	$NetBSD: uhid.c,v 1.57 2003/03/11 16:44:00 augustss Exp $	*/
 
 /*
@@ -168,6 +168,10 @@ uhid_detach(struct device *self, int flags)
 	mn = self->dv_unit;
 	vdevgone(maj, mn, mn, VCHR);
 
+	s = splusb();
+	klist_invalidate(&sc->sc_rsel.si_note);
+	splx(s);
+
 	return (0);
 }