Date: Tue, 4 Jan 2005 21:13:54 +0200 From: Peter Pentchev <roam@ringlet.net> To: Julian Elischer <julian@FreeBSD.org> Cc: freebsd-usb@FreeBSD.org Subject: [PATCH] ugen_destroy_devnodes panic Message-ID: <20050104191354.GA1916@straylight.m.ringlet.net>
next in thread | raw e-mail | index | archive | help
--VbJkn9YxBvnuCH5J
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Hi,
I am getting reproducible panics on RELENG_5 with ugen and my camera,
Canon PowerShot A80. The problem seems to be that ugen_set_config()
calls ugen_destroy_devnodes() twice, and ugen_destroy_devnodes() may get
to operate on the same sc's and the same devs, thus calling
destroy_dev() on an already destroyed endpoint device. My first hunch
was to comment out the first ugen_destroy_devnodes() call in
ugen_set_config(), but then I realized that it might be necessary to
make sure no one else tries to open a ugen endpoint while it is being
marked for destruction.
What do you think about the following patch which makes
ugen_destroy_devnodes() zero out the dev pointer for each destroyed
device, so that it never attempts to destroy the same device twice? Am
I right to think that after this routine is called, no one should use
the device endpoint that it freed?
G'luck,
Peter
Index: src/sys/dev/usb/ugen.c
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
RCS file: /home/ncvs/src/sys/dev/usb/ugen.c,v
retrieving revision 1.88.2.2
diff -u -r1.88.2.2 ugen.c
--- src/sys/dev/usb/ugen.c 31 Dec 2004 08:01:48 -0000 1.88.2.2
+++ src/sys/dev/usb/ugen.c 4 Jan 2005 18:20:39 -0000
@@ -283,7 +283,7 @@
ugen_destroy_devnodes(struct ugen_softc *sc)
{
int endptno;
- struct cdev *dev;
+ struct cdev **pdev;
=20
/* destroy all devices for the other (existing) endpoints as well */
for (endptno =3D 1; endptno < USB_MAX_ENDPOINTS; endptno++) {
@@ -298,10 +298,13 @@
* of the structs is populated.
*/
if (sc->sc_endpoints[endptno][IN].sc !=3D NULL)
- dev =3D sc->sc_endpoints[endptno][IN].dev;
+ pdev =3D &sc->sc_endpoints[endptno][IN].dev;
else
- dev =3D sc->sc_endpoints[endptno][OUT].dev;
- destroy_dev(dev);
+ pdev =3D &sc->sc_endpoints[endptno][OUT].dev;
+ if (*pdev =3D=3D NULL)
+ continue;
+ destroy_dev(*pdev);
+ *pdev =3D NULL;
}
}
}
--=20
Peter Pentchev roam@ringlet.net roam@cnsys.bg roam@FreeBSD.org
PGP key: http://people.FreeBSD.org/~roam/roam.key.asc
Key fingerprint FDBA FD79 C26F 3C51 C95E DF9E ED18 B68D 1619 4553
This sentence is false.
--VbJkn9YxBvnuCH5J
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (FreeBSD)
iD8DBQFB2ury7Ri2jRYZRVMRAgEdAJ9Y1r5cbjA09ojETQxePI2u4gTWrQCfYWzq
m788LtVAQ/uDfktLACfXfQM=
=gFUP
-----END PGP SIGNATURE-----
--VbJkn9YxBvnuCH5J--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20050104191354.GA1916>