From owner-freebsd-usb@FreeBSD.ORG Tue Jan 4 19:19:36 2005 Return-Path: Delivered-To: freebsd-usb@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 3963B16A4CF for ; Tue, 4 Jan 2005 19:19:36 +0000 (GMT) Received: from gandalf.online.bg (gandalf.online.bg [217.75.128.9]) by mx1.FreeBSD.org (Postfix) with SMTP id 8C09143D2F for ; Tue, 4 Jan 2005 19:19:34 +0000 (GMT) (envelope-from roam@ringlet.net) Received: (qmail 22703 invoked from network); 4 Jan 2005 19:19:28 -0000 Received: from unknown (HELO straylight.ringlet.net) (213.16.36.85) by gandalf.online.bg with SMTP; 4 Jan 2005 19:19:28 -0000 Received: (qmail 2489 invoked by uid 1000); 4 Jan 2005 19:13:54 -0000 Date: Tue, 4 Jan 2005 21:13:54 +0200 From: Peter Pentchev To: Julian Elischer Message-ID: <20050104191354.GA1916@straylight.m.ringlet.net> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="VbJkn9YxBvnuCH5J" Content-Disposition: inline User-Agent: Mutt/1.5.6i cc: freebsd-usb@FreeBSD.org Subject: [PATCH] ugen_destroy_devnodes panic X-BeenThere: freebsd-usb@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: FreeBSD support for USB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Jan 2005 19:19:36 -0000 --VbJkn9YxBvnuCH5J Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hi, I am getting reproducible panics on RELENG_5 with ugen and my camera, Canon PowerShot A80. The problem seems to be that ugen_set_config() calls ugen_destroy_devnodes() twice, and ugen_destroy_devnodes() may get to operate on the same sc's and the same devs, thus calling destroy_dev() on an already destroyed endpoint device. My first hunch was to comment out the first ugen_destroy_devnodes() call in ugen_set_config(), but then I realized that it might be necessary to make sure no one else tries to open a ugen endpoint while it is being marked for destruction. What do you think about the following patch which makes ugen_destroy_devnodes() zero out the dev pointer for each destroyed device, so that it never attempts to destroy the same device twice? Am I right to think that after this routine is called, no one should use the device endpoint that it freed? G'luck, Peter Index: src/sys/dev/usb/ugen.c =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D RCS file: /home/ncvs/src/sys/dev/usb/ugen.c,v retrieving revision 1.88.2.2 diff -u -r1.88.2.2 ugen.c --- src/sys/dev/usb/ugen.c 31 Dec 2004 08:01:48 -0000 1.88.2.2 +++ src/sys/dev/usb/ugen.c 4 Jan 2005 18:20:39 -0000 @@ -283,7 +283,7 @@ ugen_destroy_devnodes(struct ugen_softc *sc) { int endptno; - struct cdev *dev; + struct cdev **pdev; =20 /* destroy all devices for the other (existing) endpoints as well */ for (endptno =3D 1; endptno < USB_MAX_ENDPOINTS; endptno++) { @@ -298,10 +298,13 @@ * of the structs is populated. */ if (sc->sc_endpoints[endptno][IN].sc !=3D NULL) - dev =3D sc->sc_endpoints[endptno][IN].dev; + pdev =3D &sc->sc_endpoints[endptno][IN].dev; else - dev =3D sc->sc_endpoints[endptno][OUT].dev; - destroy_dev(dev); + pdev =3D &sc->sc_endpoints[endptno][OUT].dev; + if (*pdev =3D=3D NULL) + continue; + destroy_dev(*pdev); + *pdev =3D NULL; } } } --=20 Peter Pentchev roam@ringlet.net roam@cnsys.bg roam@FreeBSD.org PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint FDBA FD79 C26F 3C51 C95E DF9E ED18 B68D 1619 4553 This sentence is false. --VbJkn9YxBvnuCH5J Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (FreeBSD) iD8DBQFB2ury7Ri2jRYZRVMRAgEdAJ9Y1r5cbjA09ojETQxePI2u4gTWrQCfYWzq m788LtVAQ/uDfktLACfXfQM= =gFUP -----END PGP SIGNATURE----- --VbJkn9YxBvnuCH5J--