From owner-cvs-all@FreeBSD.ORG  Sat May 29 07:51:57 2004
Return-Path: <owner-cvs-all@FreeBSD.ORG>
Delivered-To: cvs-all@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id CEB5C16A4CF; Sat, 29 May 2004 07:51:57 -0700 (PDT)
Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id B15AB43D31; Sat, 29 May 2004 07:51:57 -0700 (PDT)
	(envelope-from iedowse@FreeBSD.org)
Received: from repoman.freebsd.org (localhost [127.0.0.1])
	by repoman.freebsd.org (8.12.11/8.12.11) with ESMTP id i4TEpPVj022378;
	Sat, 29 May 2004 07:51:25 -0700 (PDT)
	(envelope-from iedowse@repoman.freebsd.org)
Received: (from iedowse@localhost)
	by repoman.freebsd.org (8.12.11/8.12.11/Submit) id i4TEpOUh022314;
	Sat, 29 May 2004 07:51:24 -0700 (PDT)
	(envelope-from iedowse)
Message-Id: <200405291451.i4TEpOUh022314@repoman.freebsd.org>
From: Ian Dowse <iedowse@FreeBSD.org>
Date: Sat, 29 May 2004 07:51:24 -0700 (PDT)
To: src-committers@FreeBSD.org, cvs-src@FreeBSD.org,
	cvs-all@FreeBSD.org
X-FreeBSD-CVS-Branch: HEAD
Subject: cvs commit: src/sys/dev/usb usb_subr.c
X-BeenThere: cvs-all@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: CVS commit messages for the entire tree <cvs-all.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-all>,
	<mailto:cvs-all-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/cvs-all>
List-Post: <mailto:cvs-all@freebsd.org>
List-Help: <mailto:cvs-all-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-all>,
	<mailto:cvs-all-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 29 May 2004 14:51:58 -0000

iedowse     2004/05/29 07:51:23 PDT

  FreeBSD src repository

  Modified files:
    sys/dev/usb          usb_subr.c 
  Log:
  Refuse to change the configuration index if the device has open
  pipes, since open pipes are linked off a usbd_interface structure
  that is free()'d when the configuration index is changed. Attempting
  to close or use such pipes later would access freed memory and
  usually crash the system.
  
  The only driver that is known to trigger this problem is if_axe,
  which is itself at fault, but it is worth detecting the situation
  to avoid the obscure crashes that result from this type of easily
  made driver mistakes.
  
  Revision  Changes    Path
  1.64      +10 -2     src/sys/dev/usb/usb_subr.c