Date: Sun, 8 May 2005 15:46:20 +0200 From: Hans Petter Selasky <hselasky@c2i.net> To: FreeBSD-gnats-submit@FreeBSD.org Subject: usb/80777: usb_rem_task() should wait for callback to complete Message-ID: <200505081546.21939.hselasky@c2i.net> Resent-Message-ID: <200505081350.j48Do86K004343@freefall.freebsd.org>
index | next in thread | raw e-mail
>Number: 80777 >Category: usb >Synopsis: usb_rem_task() should wait for callback to complete? >Confidential: no >Severity: critical >Priority: medium >Responsible: freebsd-usb >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sun May 08 13:50:07 GMT 2005 >Closed-Date: >Last-Modified: >Originator: HPS >Release: FreeBSD 6.0-CURRENT i386 >Organization: >Environment: System: FreeBSD 6.0-CURRENT FreeBSD 6.0-CURRENT #45: Mon Mar 21 15:40:17 CET 2005 root@:/usr/obj/usr/src/sys/custom i386 >Description: In the file "/sys/dev/usb/usb.c", the function "usb_rem_task" should wait for the "usb_task_thread()" to finish execution of the callback function. Though this might be impossible due to the contexts from which this function is called. At least one place (see if_udav.c) "usb_rem_task" is called from detach, and the code expects that the callback has returned or is not called, after that "usb_rem_task" returns. Else the callback will access freed memory. >How-To-Repeat: >Fix: Maybe "usb_xxxx_task" should not be used by if_udav.c, like suggested in another PR? >Release-Note: >Audit-Trail: >Unformatted:help
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200505081546.21939.hselasky>