From owner-freebsd-current Wed Mar 1 16:11:37 2000 Delivered-To: freebsd-current@freebsd.org Received: from mailman.zeta.org.au (mailman.zeta.org.au [203.26.10.16]) by hub.freebsd.org (Postfix) with ESMTP id 8559237BE07; Wed, 1 Mar 2000 16:11:30 -0800 (PST) (envelope-from bde@zeta.org.au) Received: from bde.zeta.org.au (bde.zeta.org.au [203.2.228.102]) by mailman.zeta.org.au (8.8.7/8.8.7) with ESMTP id LAA05472; Thu, 2 Mar 2000 11:16:09 +1100 Date: Thu, 2 Mar 2000 11:10:55 +1100 (EST) From: Bruce Evans X-Sender: bde@alphplex.bde.org To: Doug Rabson Cc: Benjamin Greenwald , freebsd-current@FreeBSD.ORG, dfr@FreeBSD.ORG, yokota@FreeBSD.ORG Subject: Re: panic: free: multiple frees In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-current@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG On Wed, 1 Mar 2000, Doug Rabson wrote: > I think it was a problem with psm.c which Peter has committed a fix for > already. It bogusly freed the softc (sio.c does too but I doubt if it > would happen in normal usage). The free in sioclose() happens in normal usage after a pccard goes away. Managing softc's outside the driver is the main bogon here in IMHO. sioclose() needs to free the softc and remove it from any external tables atomically with other closedowns. It uses spltty() to prevent races. This will be fixed by using an internal table for com_addr() again. device_set_driver() has unnecessary races. It frees the softc before clearing the pointer to it. Interrupt handlers shouldn't call it, but some do. Bruce To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-current" in the body of the message