Date: Tue, 9 May 2006 01:01:27 -0400 From: Anish Mistry <mistry.7@osu.edu> To: freebsd-usb@freebsd.org Subject: Re: Fwd: Re: [PATCH] ugen detach race Message-ID: <200605090101.39901.mistry.7@osu.edu> In-Reply-To: <200604241027.44959.mistry.7@osu.edu> References: <200604241027.44959.mistry.7@osu.edu>
next in thread | previous in thread | raw e-mail | index | archive | help
--nextPart1499815.mcFusKBIPr Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline On Monday 24 April 2006 10:27, Anish Mistry wrote: > Sending to the usb list as per jhb's suggestion. > > ---------- Forwarded Message ---------- > > Subject: Re: [PATCH] ugen detach race > Date: Saturday 22 April 2006 16:22 > From: Anish Mistry <mistry.7@osu.edu> > To: freebsd-current@freebsd.org > Cc: Ian Dowse <iedowse@freebsd.org> > > On Saturday 22 April 2006 14:59, Anish Mistry wrote: > > On Wednesday 05 April 2006 04:44, Anish Mistry wrote: > > > On Wednesday 05 April 2006 03:53, Anish Mistry wrote: > > > > While working on getting hplip ported I ran across a race > > > > condition in the ugen code that causes a crash. The > > > > following patch fixes a problem where read, write, and ioctl > > > > can be called during a detach since sc_dying isn't checked > > > > before bumping the reference count. This puts the sc_dying > > > > check before the *_do_* functions are called. This includes > > > > the patch from usb/81308 to prevent polling on the control > > > > endpoint. As well as a few NULL pointer checks from NetBSD. > > > > This patch is applicable to RELENG_6. > > > > > > And CURRENT. > > > > > > > http://am-productions.biz/docs/ugen-detach-race.patch > > > > > > > > This doesn't fix the case where an application has a > > > > read/write pending and then detach is called. In this case > > > > destroy_devl will just keep looping until the read/write > > > > completes. > > > > I've updated the patch. It now includes the fix for the panic on > > detach when a process has a device open when a detach occurs.=20 > > ugen now no longer waits for the process to close the connection > > and just cuts it off. > > Applies to RELENG_6 and CURRENT. > > > > http://am-productions.biz/docs/ugen-detach-race.patch > > > > The patch should fix usb/93949 too. > > This seems to fix all the panics I'm seeing with the ugen device. > > It would be nice if this could make it into 6.1. > > I added another panic fix. An error was introduced in rev 1.94 on > ugen.c in the USB_SET_CONFIG ioctl case that calls > ugen_make_devnodes. This causes a panic since this logic was moved > to ugen_set_config a while ago. Removing the ugen_make_devnodes() > call from ugen_do_ioctl fixes the problem. This bug made it > trivial to cause a panic when there was access to any ugen device. > > http://am-productions.biz/docs/ugen-detach-race.patch I've updated the patch to fix the panic when you try to select() on an=20 output endpoint. The current implementation only allows for select()=20 on input endpoints. I don't know why this was done, but it should be=20 simple to allow select() for writes. This bug is also present in=20 NetBSD, so that needs to be fixed also. http://am-productions.biz/docs/ugen-multiple-panics.patch =2D-=20 Anish Mistry --nextPart1499815.mcFusKBIPr Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (FreeBSD) iD8DBQBEYCIzxqA5ziudZT0RAkywAJ9J32l188n2m6fj4xNEH0yACTzQqwCdHCEA i1tZlN1voNMqRn6r8Inyfmk= =d4ja -----END PGP SIGNATURE----- --nextPart1499815.mcFusKBIPr--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200605090101.39901.mistry.7>