Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 25 Mar 2009 18:17:56 +0900
From:      Weongyo Jeong <weongyo.jeong@gmail.com>
To:        Hans Petter Selasky <hselasky@c2i.net>
Cc:        Sam Leffler <sam@freebsd.org>, freebsd-usb@freebsd.org, Andrew Thompson <thompsa@freebsd.org>
Subject:   q: Memory modified after free in usb2
Message-ID:  <20090325091756.GA14916@weongyo.cdnetworks.kr>

next in thread | raw e-mail | index | archive | help
Hello Hans :),

I think porting uath(4) to usb almost have done that it works well to
associate with AP and for WPA but I'm suffered from a strange panic after
detach as follows:

  Memory modified after free 0xc4da3600(508) val=24000000 @ 0xc4da3600
  panic: Most recently used by USBdev

  cpuid = 0
  KDB: enter: panic
  [thread pid 17 tid 100036 ]
  Stopped at      kdb_enter+0x3a: movl    $0,kdb_why

The detach step is like as follows:

  usb2_transfer_unsetup(sc->sc_xfer, UATH_N_XFERS);
  ...
  uath_free_rx_data_list(sc);
  uath_free_tx_data_list(sc);
  uath_free_cmd_list(sc, sc->sc_cmd, UATH_CMD_LIST_COUNT);

that I've checked all memory leaks or calls after freeing memory but it
looks it's not a driver problem.

To solve this problem I modified codes slightly like below:

  usb2_transfer_unsetup(sc->sc_xfer, UATH_N_XFERS);
  usb2_pause_mtx(NULL, 5 * hz);
  ...
  uath_free_rx_data_list(sc);
  uath_free_tx_data_list(sc);
  uath_free_cmd_list(sc, sc->sc_cmd, UATH_CMD_LIST_COUNT);

After adding it I couldn't see `Memory modified after free' messages
anymore.  My question is that I can't understand why adding
usb2_pause_mtx() helps this symptom?

regards,
Weongyo Jeong



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20090325091756.GA14916>