Date: Mon, 12 Sep 2005 12:03:53 -0700 From: Brooks Davis <brooks@one-eyed-alien.net> To: John Baldwin <jhb@FreeBSD.org> Cc: cvs-src@FreeBSD.org, src-committers@FreeBSD.org, cvs-all@FreeBSD.org, Ken Smith <kensmith@FreeBSD.org> Subject: Re: cvs commit: src/sys/dev/hme if_hme.c Message-ID: <20050912190353.GC24946@odin.ac.hmc.edu> In-Reply-To: <200509121451.15539.jhb@FreeBSD.org> References: <200509081350.j88DoG5s039090@repoman.freebsd.org> <200509121451.15539.jhb@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --]
On Mon, Sep 12, 2005 at 02:51:14PM -0400, John Baldwin wrote:
> On Thursday 08 September 2005 09:50 am, Ken Smith wrote:
> > kensmith 2005-09-08 13:50:16 UTC
> >
> > FreeBSD src repository
> >
> > Modified files:
> > sys/dev/hme if_hme.c
> > Log:
> > Move hme_stop() after ether_ifdetach() and if_free() to prevent a
> > memory-referenced-after-free panic if the hme interface fails to
> > attach.
> >
> > Patch obtained from: marius
> > Suggested same thing: brooks
> >
> > MFC after: 3 days
>
> Umm, can't this lead to panics due to hme_intr() dereferencing sc_ifp? Why
> not do what all the other ethernet drivers do:
>
> if (device_is_attached(dev)) {
> HME_LOCK(sc);
> hme_stop(sc);
> HME_UNLOCK(sc);
> callout_drain(..);
> ether_ifdetach(...);
> if_free(...);
> }
>
> For references of similar drivers look at the detach methods for xl(4),
> pcn(4), wb(4), dc(4), sf(4), etc.
The commit message is backwards. It's actually correcting this bug (I
think Ken sent a followup).
-- Brooks
--
Any statement of the form "X is the one, true Y" is FALSE.
PGP fingerprint 655D 519C 26A7 82E7 2529 9BF0 5D8E 8BE9 F238 1AD4
[-- Attachment #2 --]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQFDJdEZXY6L6fI4GtQRAr3rAJoC/4ls87kh5dVDQ7gPoLOCaNYnHACfXcqp
kCrgYxpv1eGRaplHN/JxMLI=
=GAMW
-----END PGP SIGNATURE-----
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20050912190353.GC24946>