From owner-freebsd-current@FreeBSD.ORG Tue Jan 10 11:22:20 2006 Return-Path: X-Original-To: freebsd-current@freebsd.org Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id EE91216A420 for ; Tue, 10 Jan 2006 11:22:20 +0000 (GMT) (envelope-from PeterJeremy@optushome.com.au) Received: from mail25.syd.optusnet.com.au (mail25.syd.optusnet.com.au [211.29.133.166]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3A37E43D45 for ; Tue, 10 Jan 2006 11:22:20 +0000 (GMT) (envelope-from PeterJeremy@optushome.com.au) Received: from cirb503493.alcatel.com.au (c220-239-19-236.belrs4.nsw.optusnet.com.au [220.239.19.236]) by mail25.syd.optusnet.com.au (8.12.11/8.12.11) with ESMTP id k0ABMHPs019462 (version=TLSv1/SSLv3 cipher=EDH-RSA-DES-CBC3-SHA bits=168 verify=NO) for ; Tue, 10 Jan 2006 22:22:18 +1100 Received: from cirb503493.alcatel.com.au (localhost.alcatel.com.au [127.0.0.1]) by cirb503493.alcatel.com.au (8.12.10/8.12.10) with ESMTP id k0ABMHHh061255 for ; Tue, 10 Jan 2006 22:22:17 +1100 (EST) (envelope-from pjeremy@cirb503493.alcatel.com.au) Received: (from pjeremy@localhost) by cirb503493.alcatel.com.au (8.12.10/8.12.9/Submit) id k0ABMHIA061254 for freebsd-current@freebsd.org; Tue, 10 Jan 2006 22:22:17 +1100 (EST) (envelope-from pjeremy) Date: Tue, 10 Jan 2006 22:22:17 +1100 From: Peter Jeremy To: freebsd-current@freebsd.org Message-ID: <20060110112217.GH60380@cirb503493.alcatel.com.au> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.4.2.1i X-PGP-Key: http://members.optusnet.com.au/peterjeremy/pubkey.asc Subject: "Use after free" error during kldunload X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Jan 2006 11:22:21 -0000 I got an unexpected and reproducable "page fault while in kernel mode" whilst unloading a device driver. The offending address indicates that a pointer contains 0xdeadc0de. This part of the code used to work (long ago - it's been a while since I've tried kldunload'ing it, possibly since 5.3 or so). Can anyone suggest what I am doing wrong. The relevant part of the backtrace looks like: --- trap 0xc, eip = 0xc056229a, esp = 0xd6b9cae4, ebp = 0xd6b9caf0 --- device_delete_child(c32e6900,deadc0de,c3379610,d6b9cb1c,c04a1fb6) at device_delete_child+0xa device_delete_child(c3350100,c32e6900,c3350100,c3350100,d6b9cb40) at device_delete_child+0x1d iicsmb_detach(c3350100,c3321050,c0748228,965,c3350100) at iicsmb_detach+0x36 device_detach(c3350100,c32e6900,c336e100,d6b9cb68,c05622ad) at device_detach+0x8e device_delete_child(c336e100,c3350100,c338f000,d6b9cb88,c087fd7f) at device_delete_child+0x30 device_delete_child(c3371180,c336e100,0,c33a2e00,c3371180) at device_delete_child+0x1d release_resources(c338f000,c0886928,c3371180,c3371180,d6b9cbc4) at release_resources+0xdf saa_detach(c3371180,c3331850,c0748228,965,c331e9a0) at saa_detach+0x84 device_detach(c3371180,c0885188,c3371180,c32f0380,c0886940) at device_detach+0x8e devclass_delete_driver(c32f0380,c0886928,1,c3281c80,c3281c80) at devclass_delete_driver+0x95 driver_module_handler(c3281c80,1,c0886940) at driver_module_handler+0xf3 module_unload(c3281c80,0,1fb,0,0) at module_unload+0x60 linker_file_unload(c32a2e00,0,c0707925,327,2) at linker_file_unload+0x87 kern_kldunload(c3a30600,2,0,d6b9cd30,c06c3d63) at kern_kldunload+0x94 kldunloadf(c3a30600,d6b9cd04,8,440,c3b6b318) at kldunloadf+0x2c I have a crashdump but kgdb is reporting more 0xdeadcode's in locations that don't make sense (it would have panic'd much earlier if they were correct). saa_detach() and release_resources() are in my driver. The attach code looks like: saa_attach(device_t dev) { struct saa_softc *sc; sc = (struct saa_softc *)device_get_softc(dev); sc->sc_dev = dev; ... sc->sc_iicbus_dev = device_add_child(dev, "iicbus", -1); if (!sc->sc_iicbus_dev || bus_generic_attach(dev)) { emsg = "Error adding iicbus device"; goto attach_failed; } ... } The detach code (in release_resources) looks like: rval = device_delete_child(sc->sc_dev, sc->sc_iicbus_dev); -- Peter Jeremy