From owner-freebsd-bugs  Fri Jun 29 13:20: 8 2001
Delivered-To: freebsd-bugs@hub.freebsd.org
Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21])
	by hub.freebsd.org (Postfix) with ESMTP id 4AAFC37B405
	for <freebsd-bugs@hub.freebsd.org>; Fri, 29 Jun 2001 13:20:04 -0700 (PDT)
	(envelope-from gnats@FreeBSD.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.11.3/8.11.3) id f5TKK4X38664;
	Fri, 29 Jun 2001 13:20:04 -0700 (PDT)
	(envelope-from gnats)
Date: Fri, 29 Jun 2001 13:20:04 -0700 (PDT)
Message-Id: <200106292020.f5TKK4X38664@freefall.freebsd.org>
To: freebsd-bugs@FreeBSD.org
Cc: 
From: Ian Logan <ianlogan@qwest.net>
Subject: Re: kern/27370: kernel crash when trying to query the USB device "wingman rumblepad" (logitech gamepad)
Reply-To: Ian Logan <ianlogan@qwest.net>
Sender: owner-freebsd-bugs@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-bugs.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo?subject=subscribe%20freebsd-bugs>
List-Unsubscribe: <mailto:majordomo?subject=unsubscribe%20freebsd-bugs>
X-Loop: FreeBSD.org

The following reply was made to PR kern/27370; it has been noted by GNATS.

From: Ian Logan <ianlogan@qwest.net>
To: freebsd-gnats-submit@FreeBSD.org, alec@barea.org
Cc: ian@nmsu.edu
Subject: Re: kern/27370: kernel crash when trying to query the USB device "wingman rumblepad" (logitech gamepad)
Date: Fri, 29 Jun 2001 14:14:51 -0600

 Hi,
 On my current box (running current from yesterday)  the problem seems to be 
 that uhid.c's attach function is trying to free the same memory twice.
 uhid_attach calls usbd_alloc_report_desc (line 229 or so), 
 usbd_alloc_report_desc calls usbd_get_report_desc which fails.
 The usbd_alloc_report_desc free's the descriptor, and then
 uhid_attach tries to free it again.  uhid_attach seems to be the only function
 which tries to free the descriptor if usbd_alloc_report_desc fails. Removing
 the free fixes this.  
 Thanks,
 Ian
 
 *** uhid.c.orig	Fri Jun 29 13:43:28 2001
 --- uhid.c	Fri Jun 29 13:43:46 2001
 ***************
 *** 230,237 ****
   	if (err) {
   		printf("%s: no report descriptor\n", USBDEVNAME(sc->sc_dev));
   		sc->sc_dying = 1;
 - 		if (desc != NULL)
 - 			free(desc, M_USBDEV);
   		USB_ATTACH_ERROR_RETURN;
   	}
   	
 --- 230,235 ----
 ;

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message