Date: Wed, 5 Apr 2006 04:44:51 -0400 From: Anish Mistry <mistry.7@osu.edu> To: freebsd-current@freebsd.org Subject: Re: [PATCH] ugen detach race Message-ID: <200604050444.51670.mistry.7@osu.edu> In-Reply-To: <200604050354.19659.mistry.7@osu.edu> References: <200604050354.19659.mistry.7@osu.edu>
next in thread | previous in thread | raw e-mail | index | archive | help
--nextPart3010816.88CGtNQh18 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline On Wednesday 05 April 2006 03:53, Anish Mistry wrote: > While working on getting hplip ported I ran across a race > condition in the ugen code that causes a crash. The following > patch fixes a problem where read, write, and ioctl can be called > during a detach since sc_dying isn't checked before bumping the > reference count. This puts the sc_dying check before the *_do_* > functions are called. This includes the patch from usb/81308 to > prevent polling on the control endpoint. As well as a few NULL > pointer checks from NetBSD. This patch is applicable to RELENG_6. And CURRENT. > http://am-productions.biz/docs/ugen-detach-race.patch > > This doesn't fix the case where an application has a read/write > pending and then detach is called. In this case destroy_devl will > just keep looping until the read/write completes. =2D-=20 Anish Mistry --nextPart3010816.88CGtNQh18 Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (FreeBSD) iD8DBQBEM4ODxqA5ziudZT0RAu9UAJ94AfM2fkvSbL9Eh8q0G5488caJOACfbLyn T2TqceWKJtOy5AFDI3+s5ys= =q5+p -----END PGP SIGNATURE----- --nextPart3010816.88CGtNQh18--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200604050444.51670.mistry.7>