Date: Tue, 4 Jan 2005 21:13:54 +0200 From: Peter Pentchev <roam@ringlet.net> To: Julian Elischer <julian@FreeBSD.org> Cc: freebsd-usb@FreeBSD.org Subject: [PATCH] ugen_destroy_devnodes panic Message-ID: <20050104191354.GA1916@straylight.m.ringlet.net>
index | next in thread | raw e-mail
[-- Attachment #1 --]
Hi,
I am getting reproducible panics on RELENG_5 with ugen and my camera,
Canon PowerShot A80. The problem seems to be that ugen_set_config()
calls ugen_destroy_devnodes() twice, and ugen_destroy_devnodes() may get
to operate on the same sc's and the same devs, thus calling
destroy_dev() on an already destroyed endpoint device. My first hunch
was to comment out the first ugen_destroy_devnodes() call in
ugen_set_config(), but then I realized that it might be necessary to
make sure no one else tries to open a ugen endpoint while it is being
marked for destruction.
What do you think about the following patch which makes
ugen_destroy_devnodes() zero out the dev pointer for each destroyed
device, so that it never attempts to destroy the same device twice? Am
I right to think that after this routine is called, no one should use
the device endpoint that it freed?
G'luck,
Peter
Index: src/sys/dev/usb/ugen.c
===================================================================
RCS file: /home/ncvs/src/sys/dev/usb/ugen.c,v
retrieving revision 1.88.2.2
diff -u -r1.88.2.2 ugen.c
--- src/sys/dev/usb/ugen.c 31 Dec 2004 08:01:48 -0000 1.88.2.2
+++ src/sys/dev/usb/ugen.c 4 Jan 2005 18:20:39 -0000
@@ -283,7 +283,7 @@
ugen_destroy_devnodes(struct ugen_softc *sc)
{
int endptno;
- struct cdev *dev;
+ struct cdev **pdev;
/* destroy all devices for the other (existing) endpoints as well */
for (endptno = 1; endptno < USB_MAX_ENDPOINTS; endptno++) {
@@ -298,10 +298,13 @@
* of the structs is populated.
*/
if (sc->sc_endpoints[endptno][IN].sc != NULL)
- dev = sc->sc_endpoints[endptno][IN].dev;
+ pdev = &sc->sc_endpoints[endptno][IN].dev;
else
- dev = sc->sc_endpoints[endptno][OUT].dev;
- destroy_dev(dev);
+ pdev = &sc->sc_endpoints[endptno][OUT].dev;
+ if (*pdev == NULL)
+ continue;
+ destroy_dev(*pdev);
+ *pdev = NULL;
}
}
}
--
Peter Pentchev roam@ringlet.net roam@cnsys.bg roam@FreeBSD.org
PGP key: http://people.FreeBSD.org/~roam/roam.key.asc
Key fingerprint FDBA FD79 C26F 3C51 C95E DF9E ED18 B68D 1619 4553
This sentence is false.
[-- Attachment #2 --]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (FreeBSD)
iD8DBQFB2ury7Ri2jRYZRVMRAgEdAJ9Y1r5cbjA09ojETQxePI2u4gTWrQCfYWzq
m788LtVAQ/uDfktLACfXfQM=
=gFUP
-----END PGP SIGNATURE-----
help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20050104191354.GA1916>