From owner-svn-src-stable-7@FreeBSD.ORG Fri Apr 3 03:25:01 2009 Return-Path: Delivered-To: svn-src-stable-7@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 46D0410656D9; Fri, 3 Apr 2009 03:25:01 +0000 (UTC) (envelope-from weongyo@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 26CD08FC08; Fri, 3 Apr 2009 03:25:01 +0000 (UTC) (envelope-from weongyo@FreeBSD.org) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id n333P1gS097993; Fri, 3 Apr 2009 03:25:01 GMT (envelope-from weongyo@svn.freebsd.org) Received: (from weongyo@localhost) by svn.freebsd.org (8.14.3/8.14.3/Submit) id n333P12f097991; Fri, 3 Apr 2009 03:25:01 GMT (envelope-from weongyo@svn.freebsd.org) Message-Id: <200904030325.n333P12f097991@svn.freebsd.org> From: Weongyo Jeong Date: Fri, 3 Apr 2009 03:25:00 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-7@freebsd.org X-SVN-Group: stable-7 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r190666 - in stable/7/sys: . contrib/pf dev/ath/ath_hal dev/cxgb dev/malo X-BeenThere: svn-src-stable-7@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: SVN commit messages for only the 7-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Apr 2009 03:25:02 -0000 Author: weongyo Date: Fri Apr 3 03:25:00 2009 New Revision: 190666 URL: http://svn.freebsd.org/changeset/base/190666 Log: MFC r190541: fix a bug of uses after free. Pointed by: dchagin MFC r190544: handles more exceptional cases when the driver failed to attach. MFC r190550: corrects a error message. MFC r190590: fix a bug that it passed a incorrect flag BUS_DMA_ALLOCNOW to create a device specific DMA tag. On amd64 it could exhaust all of bounce pages when bus_dma_tag_create(9) is called at malo_pci_attach() then as result in next turn it returns ENOMEM. This fix a attach fail on amd64. Pointed by: yongari Tested by: dchagin Approved by: re (kib) Modified: stable/7/sys/ (props changed) stable/7/sys/contrib/pf/ (props changed) stable/7/sys/dev/ath/ath_hal/ (props changed) stable/7/sys/dev/cxgb/ (props changed) stable/7/sys/dev/malo/if_malo_pci.c stable/7/sys/dev/malo/if_malohal.c Modified: stable/7/sys/dev/malo/if_malo_pci.c ============================================================================== --- stable/7/sys/dev/malo/if_malo_pci.c Fri Apr 3 03:04:26 2009 (r190665) +++ stable/7/sys/dev/malo/if_malo_pci.c Fri Apr 3 03:25:00 2009 (r190666) @@ -245,7 +245,7 @@ malo_pci_attach(device_t dev) BUS_SPACE_MAXADDR, /* maxsize */ 0, /* nsegments */ BUS_SPACE_MAXADDR, /* maxsegsize */ - BUS_DMA_ALLOCNOW, /* flags */ + 0, /* flags */ NULL, /* lockfunc */ NULL, /* lockarg */ &sc->malo_dmat)) { @@ -260,12 +260,13 @@ malo_pci_attach(device_t dev) error = malo_attach(pci_get_device(dev), sc); - if (error != 0) { - malo_pci_detach(dev); - return (error); - } + if (error != 0) + goto bad2; return (error); + +bad2: + bus_dma_tag_destroy(sc->malo_dmat); bad1: if (psc->malo_msi == 0) bus_teardown_intr(dev, psc->malo_res_irq[0], @@ -275,10 +276,11 @@ bad1: bus_teardown_intr(dev, psc->malo_res_irq[i], psc->malo_intrhand[i]); } - + bus_release_resources(dev, psc->malo_irq_spec, psc->malo_res_irq); bad: if (psc->malo_msi != 0) pci_release_msi(dev); + bus_release_resources(dev, psc->malo_mem_spec, psc->malo_res_mem); return (error); } Modified: stable/7/sys/dev/malo/if_malohal.c ============================================================================== --- stable/7/sys/dev/malo/if_malohal.c Fri Apr 3 03:04:26 2009 (r190665) +++ stable/7/sys/dev/malo/if_malohal.c Fri Apr 3 03:25:00 2009 (r190666) @@ -128,7 +128,7 @@ malo_hal_attach(device_t dev, uint16_t d NULL, /* lockarg */ &mh->mh_dmat); if (error != 0) { - device_printf(dev, "unable to allocate memory for cmd buffer, " + device_printf(dev, "unable to allocate memory for cmd tag, " "error %u\n", error); goto fail; } @@ -163,8 +163,6 @@ malo_hal_attach(device_t dev, uint16_t d return (mh); fail: - free(mh, M_DEVBUF); - if (mh->mh_dmamap != NULL) { bus_dmamap_unload(mh->mh_dmat, mh->mh_dmamap); if (mh->mh_cmdbuf != NULL) @@ -174,6 +172,7 @@ fail: } if (mh->mh_dmat) bus_dma_tag_destroy(mh->mh_dmat); + free(mh, M_DEVBUF); return (NULL); }