Date: Mon, 12 Sep 2005 14:51:14 -0400 From: John Baldwin <jhb@FreeBSD.org> To: Ken Smith <kensmith@FreeBSD.org> Cc: cvs-src@FreeBSD.org, src-committers@FreeBSD.org, cvs-all@FreeBSD.org Subject: Re: cvs commit: src/sys/dev/hme if_hme.c Message-ID: <200509121451.15539.jhb@FreeBSD.org> In-Reply-To: <200509081350.j88DoG5s039090@repoman.freebsd.org> References: <200509081350.j88DoG5s039090@repoman.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thursday 08 September 2005 09:50 am, Ken Smith wrote: > kensmith 2005-09-08 13:50:16 UTC > > FreeBSD src repository > > Modified files: > sys/dev/hme if_hme.c > Log: > Move hme_stop() after ether_ifdetach() and if_free() to prevent a > memory-referenced-after-free panic if the hme interface fails to > attach. > > Patch obtained from: marius > Suggested same thing: brooks > > MFC after: 3 days Umm, can't this lead to panics due to hme_intr() dereferencing sc_ifp? Why not do what all the other ethernet drivers do: if (device_is_attached(dev)) { HME_LOCK(sc); hme_stop(sc); HME_UNLOCK(sc); callout_drain(..); ether_ifdetach(...); if_free(...); } For references of similar drivers look at the detach methods for xl(4), pcn(4), wb(4), dc(4), sf(4), etc. -- John Baldwin <jhb@FreeBSD.org> <>< http://www.FreeBSD.org/~jhb/ "Power Users Use the Power to Serve" = http://www.FreeBSD.org
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200509121451.15539.jhb>