Date: Mon, 12 Sep 2005 14:51:14 -0400 From: John Baldwin <jhb@FreeBSD.org> To: Ken Smith <kensmith@FreeBSD.org> Cc: cvs-src@FreeBSD.org, src-committers@FreeBSD.org, cvs-all@FreeBSD.org Subject: Re: cvs commit: src/sys/dev/hme if_hme.c Message-ID: <200509121451.15539.jhb@FreeBSD.org> In-Reply-To: <200509081350.j88DoG5s039090@repoman.freebsd.org> References: <200509081350.j88DoG5s039090@repoman.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thursday 08 September 2005 09:50 am, Ken Smith wrote:
> kensmith 2005-09-08 13:50:16 UTC
>
> FreeBSD src repository
>
> Modified files:
> sys/dev/hme if_hme.c
> Log:
> Move hme_stop() after ether_ifdetach() and if_free() to prevent a
> memory-referenced-after-free panic if the hme interface fails to
> attach.
>
> Patch obtained from: marius
> Suggested same thing: brooks
>
> MFC after: 3 days
Umm, can't this lead to panics due to hme_intr() dereferencing sc_ifp? Why
not do what all the other ethernet drivers do:
if (device_is_attached(dev)) {
HME_LOCK(sc);
hme_stop(sc);
HME_UNLOCK(sc);
callout_drain(..);
ether_ifdetach(...);
if_free(...);
}
For references of similar drivers look at the detach methods for xl(4),
pcn(4), wb(4), dc(4), sf(4), etc.
--
John Baldwin <jhb@FreeBSD.org> <>< http://www.FreeBSD.org/~jhb/
"Power Users Use the Power to Serve" = http://www.FreeBSD.org
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200509121451.15539.jhb>