From owner-cvs-src@FreeBSD.ORG  Mon Sep 12 18:50:15 2005
Return-Path: <owner-cvs-src@FreeBSD.ORG>
X-Original-To: cvs-src@FreeBSD.org
Delivered-To: cvs-src@FreeBSD.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 9FA0416A420;
	Mon, 12 Sep 2005 18:50:15 +0000 (GMT) (envelope-from jhb@FreeBSD.org)
Received: from mv.twc.weather.com (mv.twc.weather.com [65.212.71.225])
	by mx1.FreeBSD.org (Postfix) with ESMTP id A931C43D46;
	Mon, 12 Sep 2005 18:50:14 +0000 (GMT) (envelope-from jhb@FreeBSD.org)
Received: from [10.50.41.233] (Not Verified[10.50.41.233]) by
	mv.twc.weather.com with NetIQ MailMarshal (v6, 0, 3, 8)
	id <B4325d18e0001>; Mon, 12 Sep 2005 15:05:50 -0400
From: John Baldwin <jhb@FreeBSD.org>
To: Ken Smith <kensmith@FreeBSD.org>
Date: Mon, 12 Sep 2005 14:51:14 -0400
User-Agent: KMail/1.8
References: <200509081350.j88DoG5s039090@repoman.freebsd.org>
In-Reply-To: <200509081350.j88DoG5s039090@repoman.freebsd.org>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-6"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200509121451.15539.jhb@FreeBSD.org>
Cc: cvs-src@FreeBSD.org, src-committers@FreeBSD.org, cvs-all@FreeBSD.org
Subject: Re: cvs commit: src/sys/dev/hme if_hme.c
X-BeenThere: cvs-src@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: CVS commit messages for the src tree <cvs-src.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-src>,
	<mailto:cvs-src-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/cvs-src>
List-Post: <mailto:cvs-src@freebsd.org>
List-Help: <mailto:cvs-src-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-src>,
	<mailto:cvs-src-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 12 Sep 2005 18:50:16 -0000

On Thursday 08 September 2005 09:50 am, Ken Smith wrote:
> kensmith    2005-09-08 13:50:16 UTC
>
>   FreeBSD src repository
>
>   Modified files:
>     sys/dev/hme          if_hme.c
>   Log:
>   Move hme_stop() after ether_ifdetach() and if_free() to prevent a
>   memory-referenced-after-free panic if the hme interface fails to
>   attach.
>
>   Patch obtained from:    marius
>   Suggested same thing:   brooks
>
>   MFC after:      3 days

Umm, can't this lead to panics due to hme_intr() dereferencing sc_ifp?  Why 
not do what all the other ethernet drivers do:

	if (device_is_attached(dev)) {
		HME_LOCK(sc);
		hme_stop(sc);
		HME_UNLOCK(sc);
		callout_drain(..);
		ether_ifdetach(...);
		if_free(...);
	}

For references of similar drivers look at the detach methods for xl(4), 
pcn(4), wb(4), dc(4), sf(4), etc.

-- 
John Baldwin <jhb@FreeBSD.org>  <><  http://www.FreeBSD.org/~jhb/
"Power Users Use the Power to Serve"  =  http://www.FreeBSD.org