Date: Fri, 29 Jun 2001 13:20:04 -0700 (PDT) From: Ian Logan <ianlogan@qwest.net> To: freebsd-bugs@FreeBSD.org Subject: Re: kern/27370: kernel crash when trying to query the USB device "wingman rumblepad" (logitech gamepad) Message-ID: <200106292020.f5TKK4X38664@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
The following reply was made to PR kern/27370; it has been noted by GNATS. From: Ian Logan <ianlogan@qwest.net> To: freebsd-gnats-submit@FreeBSD.org, alec@barea.org Cc: ian@nmsu.edu Subject: Re: kern/27370: kernel crash when trying to query the USB device "wingman rumblepad" (logitech gamepad) Date: Fri, 29 Jun 2001 14:14:51 -0600 Hi, On my current box (running current from yesterday) the problem seems to be that uhid.c's attach function is trying to free the same memory twice. uhid_attach calls usbd_alloc_report_desc (line 229 or so), usbd_alloc_report_desc calls usbd_get_report_desc which fails. The usbd_alloc_report_desc free's the descriptor, and then uhid_attach tries to free it again. uhid_attach seems to be the only function which tries to free the descriptor if usbd_alloc_report_desc fails. Removing the free fixes this. Thanks, Ian *** uhid.c.orig Fri Jun 29 13:43:28 2001 --- uhid.c Fri Jun 29 13:43:46 2001 *************** *** 230,237 **** if (err) { printf("%s: no report descriptor\n", USBDEVNAME(sc->sc_dev)); sc->sc_dying = 1; - if (desc != NULL) - free(desc, M_USBDEV); USB_ATTACH_ERROR_RETURN; } --- 230,235 ---- ; To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200106292020.f5TKK4X38664>