Date: Fri, 29 Jun 2001 13:20:04 -0700 (PDT) From: Ian Logan <ianlogan@qwest.net> To: freebsd-bugs@FreeBSD.org Subject: Re: kern/27370: kernel crash when trying to query the USB device "wingman rumblepad" (logitech gamepad) Message-ID: <200106292020.f5TKK4X38664@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
The following reply was made to PR kern/27370; it has been noted by GNATS.
From: Ian Logan <ianlogan@qwest.net>
To: freebsd-gnats-submit@FreeBSD.org, alec@barea.org
Cc: ian@nmsu.edu
Subject: Re: kern/27370: kernel crash when trying to query the USB device "wingman rumblepad" (logitech gamepad)
Date: Fri, 29 Jun 2001 14:14:51 -0600
Hi,
On my current box (running current from yesterday) the problem seems to be
that uhid.c's attach function is trying to free the same memory twice.
uhid_attach calls usbd_alloc_report_desc (line 229 or so),
usbd_alloc_report_desc calls usbd_get_report_desc which fails.
The usbd_alloc_report_desc free's the descriptor, and then
uhid_attach tries to free it again. uhid_attach seems to be the only function
which tries to free the descriptor if usbd_alloc_report_desc fails. Removing
the free fixes this.
Thanks,
Ian
*** uhid.c.orig Fri Jun 29 13:43:28 2001
--- uhid.c Fri Jun 29 13:43:46 2001
***************
*** 230,237 ****
if (err) {
printf("%s: no report descriptor\n", USBDEVNAME(sc->sc_dev));
sc->sc_dying = 1;
- if (desc != NULL)
- free(desc, M_USBDEV);
USB_ATTACH_ERROR_RETURN;
}
--- 230,235 ----
;
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200106292020.f5TKK4X38664>