From owner-freebsd-bugs@FreeBSD.ORG Tue Dec 13 23:50:11 2011 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 5E30D1065673 for ; Tue, 13 Dec 2011 23:50:11 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 31A358FC14 for ; Tue, 13 Dec 2011 23:50:11 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.5/8.14.5) with ESMTP id pBDNoBbx012281 for ; Tue, 13 Dec 2011 23:50:11 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.5/8.14.5/Submit) id pBDNoBdx012280; Tue, 13 Dec 2011 23:50:11 GMT (envelope-from gnats) Resent-Date: Tue, 13 Dec 2011 23:50:11 GMT Resent-Message-Id: <201112132350.pBDNoBdx012280@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Yuri Pankov Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id ACF631065689 for ; Tue, 13 Dec 2011 23:47:05 +0000 (UTC) (envelope-from yuri.pankov@gmail.com) Received: from mail-ee0-f54.google.com (mail-ee0-f54.google.com [74.125.83.54]) by mx1.freebsd.org (Postfix) with ESMTP id 3C5448FC1E for ; Tue, 13 Dec 2011 23:47:04 +0000 (UTC) Received: by eekc50 with SMTP id c50so263155eek.13 for ; Tue, 13 Dec 2011 15:47:04 -0800 (PST) Received: by 10.213.6.209 with SMTP id a17mr81308eba.128.1323820023841; Tue, 13 Dec 2011 15:47:03 -0800 (PST) Received: from procyon.xvoid.org ([213.132.76.142]) by mx.google.com with ESMTPS id s16sm2685795eef.2.2011.12.13.15.47.01 (version=TLSv1/SSLv3 cipher=OTHER); Tue, 13 Dec 2011 15:47:02 -0800 (PST) Received: from procyon.xvoid.org (yuri@procyon.xvoid.org [IPv6:::1]) by procyon.xvoid.org (8.14.5/8.14.5) with ESMTP id pBDNkxHW052218 for ; Wed, 14 Dec 2011 03:46:59 +0400 (MSK) (envelope-from yuri.pankov@gmail.com) Received: (from yuri@localhost) by procyon.xvoid.org (8.14.5/8.14.5/Submit) id pBDNkxE8052217; Wed, 14 Dec 2011 03:46:59 +0400 (MSK) (envelope-from yuri.pankov@gmail.com) Message-Id: <201112132346.pBDNkxE8052217@procyon.xvoid.org> Date: Wed, 14 Dec 2011 03:46:59 +0400 (MSK) From: Yuri Pankov To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: Subject: kern/163268: [acpi_hp] fix driver detach in absence of CMI X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Yuri Pankov List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Dec 2011 23:50:11 -0000 >Number: 163268 >Category: kern >Synopsis: [acpi_hp] fix driver detach in absence of CMI >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Tue Dec 13 23:50:10 UTC 2011 >Closed-Date: >Last-Modified: >Originator: Yuri Pankov >Release: FreeBSD 9.0-RC3 amd64 >Organization: >Environment: System: FreeBSD procyon.xvoid.org 9.0-RC3 FreeBSD 9.0-RC3 #1 r228385: Sat Dec 10 07:29:02 MSK 2011 yuri@procyon.xvoid.org:/usr/obj/data/src/freebsd/releng/9.0/sys/GENERIC amd64 >Description: Unloading acpi_hp driver in absence of CMI (e.g., on HP Pavilion DV8, not sure if laptop doesn't have it or driver just doesn't recognize its presence, but anyway.. ) leads to "panic: sbuf_delete called with uninitialized or corrupt sbuf". We shouldn't try to free CMI-related resources if we didn't allocate them, fix logic here a bit. >How-To-Repeat: >Fix: --- acpi_hp.c.diff begins here --- Index: sys/dev/acpi_support/acpi_hp.c =================================================================== --- sys/dev/acpi_support/acpi_hp.c (revision 228481) +++ sys/dev/acpi_support/acpi_hp.c (working copy) @@ -573,25 +573,25 @@ static int acpi_hp_detach(device_t dev) { - int ret; - + int ret = 0; + struct acpi_hp_softc *sc = device_get_softc(dev); + ACPI_FUNCTION_TRACE((char *)(uintptr_t) __func__); - struct acpi_hp_softc *sc = device_get_softc(dev); - if (sc->has_cmi && sc->hpcmi_open_pid != 0) { - ret = EBUSY; - } - else { - if (sc->has_notify) { - ACPI_WMI_REMOVE_EVENT_HANDLER(dev, - ACPI_HP_WMI_EVENT_GUID); + + if (sc->has_notify) + ACPI_WMI_REMOVE_EVENT_HANDLER(dev, ACPI_HP_WMI_EVENT_GUID); + + if (sc->has_cmi) { + if (sc->hpcmi_open_pid != 0) { + ret = EBUSY; + } else { + if (sc->hpcmi_bufptr != -1) { + sbuf_delete(&sc->hpcmi_sbuf); + sc->hpcmi_bufptr = -1; + } + sc->hpcmi_open_pid = 0; + destroy_dev(sc->hpcmi_dev_t); } - if (sc->hpcmi_bufptr != -1) { - sbuf_delete(&sc->hpcmi_sbuf); - sc->hpcmi_bufptr = -1; - } - sc->hpcmi_open_pid = 0; - destroy_dev(sc->hpcmi_dev_t); - ret = 0; } return (ret); --- acpi_hp.c.diff ends here --- >Release-Note: >Audit-Trail: >Unformatted: