From owner-cvs-src@FreeBSD.ORG  Wed Mar 16 18:40:56 2005
Return-Path: <owner-cvs-src@FreeBSD.ORG>
Delivered-To: cvs-src@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 5F15F16A4CE; Wed, 16 Mar 2005 18:40:56 +0000 (GMT)
Received: from elvis.mu.org (elvis.mu.org [192.203.228.196])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id 3D53043D2D; Wed, 16 Mar 2005 18:40:56 +0000 (GMT)
	(envelope-from mux@freebsd.org)
Received: by elvis.mu.org (Postfix, from userid 1920)
	id 2AF255C984; Wed, 16 Mar 2005 10:40:56 -0800 (PST)
Date: Wed, 16 Mar 2005 19:40:56 +0100
From: Maxime Henrion <mux@FreeBSD.org>
To: Kris Kennaway <kris@FreeBSD.org>
Message-ID: <20050316184056.GP31320@elvis.mu.org>
References: <200503161639.j2GGd4g1083863@repoman.freebsd.org>
	<20050316181535.GA91771@hub.freebsd.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20050316181535.GA91771@hub.freebsd.org>
User-Agent: Mutt/1.4.2.1i
cc: cvs-src@FreeBSD.org
cc: src-committers@FreeBSD.org
cc: cvs-all@FreeBSD.org
Subject: Re: cvs commit: src/sys/dev/fxp if_fxp.c
X-BeenThere: cvs-src@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: CVS commit messages for the src tree <cvs-src.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-src>,
	<mailto:cvs-src-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/cvs-src>
List-Post: <mailto:cvs-src@freebsd.org>
List-Help: <mailto:cvs-src-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-src>,
	<mailto:cvs-src-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 16 Mar 2005 18:40:56 -0000

Kris Kennaway wrote:
> On Wed, Mar 16, 2005 at 04:39:04PM +0000, Maxime Henrion wrote:
> > mux         2005-03-16 16:39:04 UTC
> > 
> >   FreeBSD src repository
> > 
> >   Modified files:
> >     sys/dev/fxp          if_fxp.c 
> >   Log:
> >   Unload and destroy the TX DMA maps before destroying the DMA tag
> >   they're attached to, not after.
> >   
> >   Spotted by:     Coverity via sam
> 
> Is this likely to have caused panics at runtime?  A few people
> (including me) have seen dma-related or use-after-free panics from
> fxp.

This won't fix any use-after-free panics at runtime, since the faulty
code is in fxp_release() which will only get called from fxp_attach() in
error scenarios and from fxp_detach().

I've never seen reports about use-after-free from fxp(4), I'd like to
know about those, even if the odds of those not being false positives is
small...

Cheers,
Maxime