From nobody Wed Jun 10 04:01:19 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gZsXJ00GHz6gvkh for ; Wed, 10 Jun 2026 04:01:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gZsXH4FKsz3wJH for ; Wed, 10 Jun 2026 04:01:19 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1781064079; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=0cUGSKJUtJaEJrb5jxv7OmBjCWawgJVC3TR8PazW//U=; b=e1mnHgBCjSAu2bLYeklN+xlPsjQeVFFWG2ZHoq0ZcFjAhZFMLicaF4vK4IiDa5XV/eVcl5 k5gSbqfj2pagixKYH5FvP8mF3q8VW55zLZawvf1hOnMNYoLdhrogPAvPeQR5sV+Ib85Y87 vxMiEFx9loWY/FnPJyB4Dn7SHE92IIXqUwsd2VxSj6xZDaIR/i56fCzotAF6IzepkyGBj7 wwz9yS9hfrQci31vh07ykHbzYumc59eZf4AQZbjGoQc6fRmY4kwPCZrHjZBdoUH8hmR56e /a44gTGhit44owR1I6/v/SGZ1d4n3w+NwM84un9cNMjsgOlDpLpulA+4WWmnyQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1781064079; a=rsa-sha256; cv=none; b=LeKZMT40fDESecBh9zqEECb2KatqbfTe3ewmr0Wwep2F2d17mDDLUj/Wz2cKwuqA0d2tri fV9XipsZKIvjNEqbL3VMVW/wwc7yCpEvlcR0OA2m/PlDxfPfAtvfCMIOWccn1fCh4Fj61n wu75RQJnRZewqM6cX/Ojg1q0KJs/Ayp16Krjv3djtfw8jKsflgvUAzEDX6hXPm8jXRR64T zgZAGRtDkmj/GtFs7hRrdhZZOephZcCaTPxmH3LTjBdNUpvos4l3jtJcK6QjunZckdxhMv Z+fgMIe+PQ6vdCNTDxxRFz1jGhajycpavKPU4xjzKZE5WccwcKlybs2rsREwqg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1781064079; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=0cUGSKJUtJaEJrb5jxv7OmBjCWawgJVC3TR8PazW//U=; b=tsVyB4dm3Nd3zwNVzZs4rjaHlvf9tlCY4PSOiD3gEXsaZMG6I1Rn6G0fLAdM34KqUCmad8 x0qu8plQjjgNSWemjNeuW2oy9XG7bNGnFV/18r7xlB+TeTpGi7HJjitFgpGR0Pi7ka/hxN OaAEtO4cT4UslId54jy+GxsOjuUaFKcbbs3OG/Ub8B29RZmkjkf0c/ThB8TtVHLqASEKdn eLU1VZAtUWXA5tQRPzbzxmawEsU8xonq2WJXT7F7tgIMhHSwG1iil60jegF9OE+M/55lit Z27q6hZyVaTOddtighoHGTq8DHntBQX71Ape9wBGpB0aIpzK7nDUmloKirUV/A== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gZsXH3mD6z14dn for ; Wed, 10 Jun 2026 04:01:19 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 26462 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 10 Jun 2026 04:01:19 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Kyle Evans Subject: git: 76720b010873 - stable/15 - pci: bcm2838: cleanup on attach failure to fix devmatch panic List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kevans X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 76720b010873f350b94231c5380e2d19b8839795 Auto-Submitted: auto-generated Date: Wed, 10 Jun 2026 04:01:19 +0000 Message-Id: <6a28e18f.26462.29018d5e@gitrepo.freebsd.org> The branch stable/15 has been updated by kevans: URL: https://cgit.FreeBSD.org/src/commit/?id=76720b010873f350b94231c5380e2d19b8839795 commit 76720b010873f350b94231c5380e2d19b8839795 Author: Kyle Evans AuthorDate: 2026-05-09 02:49:35 +0000 Commit: Kyle Evans CommitDate: 2026-06-10 04:00:38 +0000 pci: bcm2838: cleanup on attach failure to fix devmatch panic Specifically on the RPi CM4, we currently don't set the controller up right and it never moves into the ready state (we don't observe the link active bit). Failure to cleanup here actually results in a panic not long after, due to a use-after-free in the rman bits. Further down in pci_host_generic, we have some rman stashed in the softc that are initialized and placed onto the rman tailq, then the softc is later freed without an rman_fini() to pull them off of the tailq properly. Note that PCIe on this board won't come up at boot without something plugged in, so it currently can't be booted with an empty slot with the intent to hotplug a supported card. Some issues with controller startup have been observed with Broadcom NICs in the wild, but no problems have been observed with other NICs and a variety of different PCIe cards. Shout-out to Vince for the extensive debugging and analysis to arrive at this conclusion. Reviewed by: andrew, imp (cherry picked from commit a05af6ddf9016e4ea4f0b361aa674e7ece6fe7ec) --- sys/arm/broadcom/bcm2835/bcm2838_pci.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/sys/arm/broadcom/bcm2835/bcm2838_pci.c b/sys/arm/broadcom/bcm2835/bcm2838_pci.c index 2b2ad1e3bdf8..80a7516f5331 100644 --- a/sys/arm/broadcom/bcm2835/bcm2838_pci.c +++ b/sys/arm/broadcom/bcm2835/bcm2838_pci.c @@ -646,7 +646,7 @@ bcm_pcib_attach(device_t dev) error = bcm_pcib_check_ranges(dev); if (error != 0) - return (error); + goto failed; mtx_init(&sc->config_mtx, "bcm_pcib: config_mtx", NULL, MTX_DEF); @@ -680,7 +680,8 @@ bcm_pcib_attach(device_t dev) if (tries > 100) { device_printf(dev, "error: controller failed to start.\n"); - return (ENXIO); + error = ENXIO; + goto failed; } DELAY(1000); @@ -690,7 +691,8 @@ bcm_pcib_attach(device_t dev) if (!link_state) { device_printf(dev, "error: controller started but link is not " "up.\n"); - return (ENXIO); + error = ENXIO; + goto failed; } if (bootverbose) device_printf(dev, "note: reported link speed is %s.\n", @@ -741,12 +743,15 @@ bcm_pcib_attach(device_t dev) /* Configure interrupts. */ error = bcm_pcib_msi_attach(dev); if (error != 0) - return (error); + goto failed; /* Done. */ device_add_child(dev, "pci", DEVICE_UNIT_ANY); bus_attach_children(dev); return (0); +failed: + pci_host_generic_destroy_fdt(dev); + return (error); } /*