From nobody Wed Jun 10 04:01:10 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gZsX751W3z6gv8S for ; Wed, 10 Jun 2026 04:01:11 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gZsX72bT9z3vy0 for ; Wed, 10 Jun 2026 04:01:11 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1781064071; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=CR9mSDgO7eyEr0N+5kN/G0CTZi1gL5VtxxPz8wj0br8=; b=b7B0Fl/UR51PTkn4GJ0xY00vnrq2sW3buwXKKPqDp+OWcCadi9FmJM6pXlCqZfPwdiuX3R p+aHpCyGBFQSn/XRsw3CSMuSu+TrToCfiDaBdaTuWw1e7yqwGtaVyYaYMfqfqCbXzHPBox ++vn3UzSLRpq0seHvTW20QB3iRRwEdNe2lbM74VJ9KB6rFBMPhDqID2WmVQmbtvz+OscV0 JDK5np/r1elr9DTgvh0SI9ydRmCnzc2r8i1ds4X4XLg1azwHbCyE2zdKBkzBy5uJCC+TgW 6qjZUlfPNgw0PGFGDYYACp0yshNQxSFOHVRPqIhNcTL6TPeLVsD8Sd989U0rDA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1781064071; a=rsa-sha256; cv=none; b=dC0lKxB3WYzYTfuyYGpULbsHqqEBdCEsnHuwpWVxPbTt4WKK1NkrelVPLwuHIodWcr1lC6 Exbz7s7kYQAjJadQ8E16fiom9lAEvNE2qWmlGdTn28FjfA6qB48HoG9O7x6SnU51ujIlOA HvbxMr1vygmZRB8Q2Q5lHgh+A0MOYGhnIwo1ddQc70fEgJC25Qom8NR45ynfWNxei0rWsl LL/owrlF0x+LIp+XCpY5tSd7+z/GNUdgWqQER3YMt0TLd5MvEl/tx8e6i4wbPEPohq1ikS LRRYQtnMRfKoBJHFt9/Li4Dh1smsTgpIUVfJvpGM7l/UdAC3bQLZ1bqRFGV/ag== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1781064071; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=CR9mSDgO7eyEr0N+5kN/G0CTZi1gL5VtxxPz8wj0br8=; b=M58Vsn+swYk/e1FCE7dKkgQomsovF1CkOBj38pBV+ntgpE4lpE1QK5mxCr3CuYMgpLOydf nSJ/Tme8M211UTNz0QWMyFjGuG8yHRPy+VZ5JQbCUUpW7mpq0IjUk+0fHfWHZ8RGUeuhoi KMPJRjXPPHTCKNicj1o2Xucxb6A/VGvBVocoqMJai4EOUjSw4JfLs3ujW+TxQ0Ip3DHCqf MsVKgutIkSKXbHidid+VAAguX1y+IMDn+/7VfHhBIYmJizm51pLkLDKNG8PQK7kECE/XZc j8qMMgfMbdCFyI9RJwv4kbW8YODcBrHrsHduM1jQx5739V2nCKAeIhZBvY10iQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gZsX66YHGz143C for ; Wed, 10 Jun 2026 04:01:10 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 2676d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 10 Jun 2026 04:01:10 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Kyle Evans Subject: git: f25b4d986c94 - stable/14 - pci: bcm2838: cleanup on attach failure to fix devmatch panic List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kevans X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: f25b4d986c949b3e0c0e20fe5cbcc42f0f004243 Auto-Submitted: auto-generated Date: Wed, 10 Jun 2026 04:01:10 +0000 Message-Id: <6a28e186.2676d.1397815@gitrepo.freebsd.org> The branch stable/14 has been updated by kevans: URL: https://cgit.FreeBSD.org/src/commit/?id=f25b4d986c949b3e0c0e20fe5cbcc42f0f004243 commit f25b4d986c949b3e0c0e20fe5cbcc42f0f004243 Author: Kyle Evans AuthorDate: 2026-05-09 02:49:35 +0000 Commit: Kyle Evans CommitDate: 2026-06-10 04:00:49 +0000 pci: bcm2838: cleanup on attach failure to fix devmatch panic Specifically on the RPi CM4, we currently don't set the controller up right and it never moves into the ready state (we don't observe the link active bit). Failure to cleanup here actually results in a panic not long after, due to a use-after-free in the rman bits. Further down in pci_host_generic, we have some rman stashed in the softc that are initialized and placed onto the rman tailq, then the softc is later freed without an rman_fini() to pull them off of the tailq properly. Note that PCIe on this board won't come up at boot without something plugged in, so it currently can't be booted with an empty slot with the intent to hotplug a supported card. Some issues with controller startup have been observed with Broadcom NICs in the wild, but no problems have been observed with other NICs and a variety of different PCIe cards. Shout-out to Vince for the extensive debugging and analysis to arrive at this conclusion. Reviewed by: andrew, imp (cherry picked from commit a05af6ddf9016e4ea4f0b361aa674e7ece6fe7ec) --- sys/arm/broadcom/bcm2835/bcm2838_pci.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/sys/arm/broadcom/bcm2835/bcm2838_pci.c b/sys/arm/broadcom/bcm2835/bcm2838_pci.c index fb3e8df783c2..a6619f4f9112 100644 --- a/sys/arm/broadcom/bcm2835/bcm2838_pci.c +++ b/sys/arm/broadcom/bcm2835/bcm2838_pci.c @@ -647,7 +647,7 @@ bcm_pcib_attach(device_t dev) error = bcm_pcib_check_ranges(dev); if (error != 0) - return (error); + goto failed; mtx_init(&sc->config_mtx, "bcm_pcib: config_mtx", NULL, MTX_DEF); @@ -681,7 +681,8 @@ bcm_pcib_attach(device_t dev) if (tries > 100) { device_printf(dev, "error: controller failed to start.\n"); - return (ENXIO); + error = ENXIO; + goto failed; } DELAY(1000); @@ -691,7 +692,8 @@ bcm_pcib_attach(device_t dev) if (!link_state) { device_printf(dev, "error: controller started but link is not " "up.\n"); - return (ENXIO); + error = ENXIO; + goto failed; } if (bootverbose) device_printf(dev, "note: reported link speed is %s.\n", @@ -742,11 +744,14 @@ bcm_pcib_attach(device_t dev) /* Configure interrupts. */ error = bcm_pcib_msi_attach(dev); if (error != 0) - return (error); + goto failed; /* Done. */ device_add_child(dev, "pci", -1); return (bus_generic_attach(dev)); +failed: + pci_host_generic_destroy_fdt(dev); + return (error); } /*