Date: Wed, 16 Mar 2005 19:40:56 +0100 From: Maxime Henrion <mux@FreeBSD.org> To: Kris Kennaway <kris@FreeBSD.org> Cc: cvs-all@FreeBSD.org Subject: Re: cvs commit: src/sys/dev/fxp if_fxp.c Message-ID: <20050316184056.GP31320@elvis.mu.org> In-Reply-To: <20050316181535.GA91771@hub.freebsd.org> References: <200503161639.j2GGd4g1083863@repoman.freebsd.org> <20050316181535.GA91771@hub.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Kris Kennaway wrote: > On Wed, Mar 16, 2005 at 04:39:04PM +0000, Maxime Henrion wrote: > > mux 2005-03-16 16:39:04 UTC > > > > FreeBSD src repository > > > > Modified files: > > sys/dev/fxp if_fxp.c > > Log: > > Unload and destroy the TX DMA maps before destroying the DMA tag > > they're attached to, not after. > > > > Spotted by: Coverity via sam > > Is this likely to have caused panics at runtime? A few people > (including me) have seen dma-related or use-after-free panics from > fxp. This won't fix any use-after-free panics at runtime, since the faulty code is in fxp_release() which will only get called from fxp_attach() in error scenarios and from fxp_detach(). I've never seen reports about use-after-free from fxp(4), I'd like to know about those, even if the odds of those not being false positives is small... Cheers, Maxime
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20050316184056.GP31320>