From owner-cvs-src@FreeBSD.ORG Wed Mar 16 21:21:10 2005 Return-Path: Delivered-To: cvs-src@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id CF1A116A4CE; Wed, 16 Mar 2005 21:21:10 +0000 (GMT) Received: from tinker.exit.com (tinker.exit.com [206.223.0.1]) by mx1.FreeBSD.org (Postfix) with ESMTP id CA68F43D2F; Wed, 16 Mar 2005 21:21:09 +0000 (GMT) (envelope-from frank@exit.com) Received: from realtime.exit.com (realtime [206.223.0.5]) by tinker.exit.com (8.13.3/8.13.3) with ESMTP id j2GLJssX034012; Wed, 16 Mar 2005 13:20:39 -0800 (PST) (envelope-from frank@exit.com) Received: from realtime.exit.com (localhost [127.0.0.1]) by realtime.exit.com (8.13.1/8.12.9) with ESMTP id j2GLJsvl012604; Wed, 16 Mar 2005 13:19:54 -0800 (PST) (envelope-from frank@realtime.exit.com) Received: (from frank@localhost) by realtime.exit.com (8.13.1/8.13.1/Submit) id j2GLJsoN012601; Wed, 16 Mar 2005 13:19:54 -0800 (PST) (envelope-from frank) From: Frank Mayhar Message-Id: <200503162119.j2GLJsoN012601@realtime.exit.com> In-Reply-To: <20050316184056.GP31320@elvis.mu.org> To: Maxime Henrion Date: Wed, 16 Mar 2005 13:19:53 -0800 (PST) X-Copyright0: Copyright 2005 Frank Mayhar. All Rights Reserved. X-Copyright1: Permission granted for electronic reproduction as Usenet News or email only. X-Mailer: ELM [version 2.4ME+ PL119 (25)] MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=US-ASCII cc: cvs-src@freebsd.org cc: Kris Kennaway Subject: Re: cvs commit: src/sys/dev/fxp if_fxp.c X-BeenThere: cvs-src@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: frank@exit.com List-Id: CVS commit messages for the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Mar 2005 21:21:10 -0000 Maxime Henrion wrote: > Kris Kennaway wrote: > > On Wed, Mar 16, 2005 at 04:39:04PM +0000, Maxime Henrion wrote: > > > mux 2005-03-16 16:39:04 UTC > > > > > > FreeBSD src repository > > > > > > Modified files: > > > sys/dev/fxp if_fxp.c > > > Log: > > > Unload and destroy the TX DMA maps before destroying the DMA tag > > > they're attached to, not after. > > > > > > Spotted by: Coverity via sam > > Is this likely to have caused panics at runtime? A few people > > (including me) have seen dma-related or use-after-free panics from > > fxp. > This won't fix any use-after-free panics at runtime, since the faulty > code is in fxp_release() which will only get called from fxp_attach() in > error scenarios and from fxp_detach(). On the other hand, this may well fix some problems I was seeing with fxp wedging during boot or panicing during kldload. (I haven't seen any use-after-free panics, though, and I use fxp pretty heavily.) -- Frank Mayhar frank@exit.com http://www.exit.com/ Exit Consulting http://www.gpsclock.com/ http://www.exit.com/blog/frank/