Date: Wed, 5 Apr 2006 03:53:57 -0400 From: Anish Mistry <mistry.7@osu.edu> To: freebsd-current@freebsd.org Subject: [PATCH] ugen detach race Message-ID: <200604050354.19659.mistry.7@osu.edu>
index | next in thread | raw e-mail
[-- Attachment #1 --] While working on getting hplip ported I ran across a race condition in the ugen code that causes a crash. The following patch fixes a problem where read, write, and ioctl can be called during a detach since sc_dying isn't checked before bumping the reference count. This puts the sc_dying check before the *_do_* functions are called. This includes the patch from usb/81308 to prevent polling on the control endpoint. As well as a few NULL pointer checks from NetBSD. This patch is applicable to RELENG_6. http://am-productions.biz/docs/ugen-detach-race.patch This doesn't fix the case where an application has a read/write pending and then detach is called. In this case destroy_devl will just keep looping until the read/write completes. -- Anish Mistry [-- Attachment #2 --] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (FreeBSD) iD8DBQBEM3erxqA5ziudZT0RAlGZAJ0TSVBxCXNRkQVXDwcGL7eGu93D6wCdExde JtVKuqPsDTCHhYN8fF0eGVs= =BEn/ -----END PGP SIGNATURE-----help
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200604050354.19659.mistry.7>