From nobody Thu Jun 4 05:15:42 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gWCSt5wycz6fwhb for ; Thu, 04 Jun 2026 05:15:42 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gWCSt3Wm5z3TBJ for ; Thu, 04 Jun 2026 05:15:42 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1780550142; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=C7cpzfKg8R9m21JnMj4bFr9t/TixCl3fWIZlcdPKyoI=; b=KesYmC03ihvA/6Tvtwmg1vkOaoin6240DdJHgPgljvCR49ALw4cLxyM4Z7jeLEKikTzCU8 V7EHAQF1vtfCnPF60KOQwBigrTyNdA8PkjlCAcs++Rcbjkzvr2wtwizausOMwBT4kiHAmS C7JOCX8rqdnoyGvBr/4eksrDp7gsbpWJkXYNmJolW9mOsmgDD6NEEWnwG0oP+ZY4W/Bv55 2JbuBgXWLYsiYJpp4BU8cYXBQLUgn14QDPuNOTvBiINSizYHZtnwmFBFWGvSYmFxZqpoiU Xlb2CJzsLlRW1reWHHmg48I0GvZ7LTLcViTrBBRQL8k7A2AUIwZhvhkKjcjmrw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1780550142; a=rsa-sha256; cv=none; b=Xd3TCJFCxfVVKtEOChFzwPCu0FMKmedREKPovvyvPPfusBOV4a/tedaI4416qaHz/nhOfA f9qIfIALecn2Hj29R/JWFyjPvtdgHSIw99rMGI3btcB/trFuZmqKbvBkwwRDwBEZA/hSSw 5YTlR54SDrOqWq4F0wH5knvLImabTHrwstGuj0+XQ2UcuJAtmaCmkyvWj5UUGO4aS+Vx8m 0jwl4G8ITgWLegP3vL+VEemS1DFdchxLFzirvjorVrLJkBHVOLDbRv8oJHcSw1LcWeK+Gp DnZ2oh9NSZEjFVWNr0TXsLcQIeEZiYOa7CfvG2WFugpXN7/2s2Dq+ZfN9geU1w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1780550142; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=C7cpzfKg8R9m21JnMj4bFr9t/TixCl3fWIZlcdPKyoI=; b=Fke/cCkREScLGMrmIBcY5EeF2VPlbhtJcO8SvIPtdiA4xdGnPE6qUGMNsmKX3Il/yroBed CbPaXShqn70GmXXUIs6O6KneD90p+4XyLqpB2yqxruA6hwAt9ImfgOggeN1t156rmZi7oI BIR7e2tt8tGANUlpvZCYVF1rj/nO4ec4pBpeeWIWbh94zyv186Yig3/7cGjawqUe0nKEU+ jeZvgZfrpDC1TUuKr2ag7vkjCxeBelDJU+cEIiWB/hxFtIusLlDZqXEep7n8x/BYDikIOR XGgJjaQUkjBZGb4B246QngDWc7SQbCXIhB6Ou+2sg0TpJZP9UtKr8rta7CXbGA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gWCSt37KZzl2f for ; Thu, 04 Jun 2026 05:15:42 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 20e0e by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 04 Jun 2026 05:15:42 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kyle Evans Subject: git: a05af6ddf901 - main - pci: bcm2838: cleanup on attach failure to fix devmatch panic List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kevans X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: a05af6ddf9016e4ea4f0b361aa674e7ece6fe7ec Auto-Submitted: auto-generated Date: Thu, 04 Jun 2026 05:15:42 +0000 Message-Id: <6a2109fe.20e0e.406e3a41@gitrepo.freebsd.org> The branch main has been updated by kevans: URL: https://cgit.FreeBSD.org/src/commit/?id=a05af6ddf9016e4ea4f0b361aa674e7ece6fe7ec commit a05af6ddf9016e4ea4f0b361aa674e7ece6fe7ec Author: Kyle Evans AuthorDate: 2026-05-09 02:49:35 +0000 Commit: Kyle Evans CommitDate: 2026-06-04 05:15:14 +0000 pci: bcm2838: cleanup on attach failure to fix devmatch panic Specifically on the RPi CM4, we currently don't set the controller up right and it never moves into the ready state (we don't observe the link active bit). Failure to cleanup here actually results in a panic not long after, due to a use-after-free in the rman bits. Further down in pci_host_generic, we have some rman stashed in the softc that are initialized and placed onto the rman tailq, then the softc is later freed without an rman_fini() to pull them off of the tailq properly. Note that PCIe on this board won't come up at boot without something plugged in, so it currently can't be booted with an empty slot with the intent to hotplug a supported card. Some issues with controller startup have been observed with Broadcom NICs in the wild, but no problems have been observed with other NICs and a variety of different PCIe cards. Shout-out to Vince for the extensive debugging and analysis to arrive at this conclusion. Reviewed by: andrew, imp Differential Revision: https://reviews.freebsd.org/D56897 --- sys/arm/broadcom/bcm2835/bcm2838_pci.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/sys/arm/broadcom/bcm2835/bcm2838_pci.c b/sys/arm/broadcom/bcm2835/bcm2838_pci.c index 2b2ad1e3bdf8..80a7516f5331 100644 --- a/sys/arm/broadcom/bcm2835/bcm2838_pci.c +++ b/sys/arm/broadcom/bcm2835/bcm2838_pci.c @@ -646,7 +646,7 @@ bcm_pcib_attach(device_t dev) error = bcm_pcib_check_ranges(dev); if (error != 0) - return (error); + goto failed; mtx_init(&sc->config_mtx, "bcm_pcib: config_mtx", NULL, MTX_DEF); @@ -680,7 +680,8 @@ bcm_pcib_attach(device_t dev) if (tries > 100) { device_printf(dev, "error: controller failed to start.\n"); - return (ENXIO); + error = ENXIO; + goto failed; } DELAY(1000); @@ -690,7 +691,8 @@ bcm_pcib_attach(device_t dev) if (!link_state) { device_printf(dev, "error: controller started but link is not " "up.\n"); - return (ENXIO); + error = ENXIO; + goto failed; } if (bootverbose) device_printf(dev, "note: reported link speed is %s.\n", @@ -741,12 +743,15 @@ bcm_pcib_attach(device_t dev) /* Configure interrupts. */ error = bcm_pcib_msi_attach(dev); if (error != 0) - return (error); + goto failed; /* Done. */ device_add_child(dev, "pci", DEVICE_UNIT_ANY); bus_attach_children(dev); return (0); +failed: + pci_host_generic_destroy_fdt(dev); + return (error); } /*