Date: Thu, 4 Jan 2007 17:52:08 +0700 From: Eugene Grosbein <eugen@www.svzserv.kemerovo.su> To: Kostik Belousov <kostikbel@gmail.com> Cc: freebsd-hackers@freebsd.org, Eugene Grosbein <eugen@kuzbass.ru> Subject: Re: WITNESS & RELENG_6 Message-ID: <20070104105208.GA78979@svzserv.kemerovo.su> In-Reply-To: <20070104103708.GF21325@deviant.kiev.zoral.com.ua> References: <20070103141820.GA1014@grosbein.pp.ru> <200701031601.05541.jhb@freebsd.org> <20070104040727.GD21325@deviant.kiev.zoral.com.ua> <20070104103708.GF21325@deviant.kiev.zoral.com.ua>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, Jan 04, 2007 at 12:37:08PM +0200, Kostik Belousov wrote: > The problem is revealed by INVARIANTS option, not by WITNESS, and is definitely the use-after-free. > > in src/nvidia_dev.c, nvidia_dev_close(), that is cdevsw.d_close proc, > the destroy_dev() is called. Please, apply rev. 1.199 of sys/kern/kern_conf.c. > I expect that crashes shall stop, but non-killable processes (in the "devdrn") > state would accumulate. > > Please, confirm. I've tried to apply 1.199 to RELENG_6 but failed: one of three chunks has been rejected. Eugene
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20070104105208.GA78979>