From owner-cvs-src@FreeBSD.ORG Mon Sep 12 22:03:31 2005 Return-Path: X-Original-To: cvs-src@FreeBSD.org Delivered-To: cvs-src@FreeBSD.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D4BCC16A41F; Mon, 12 Sep 2005 22:03:31 +0000 (GMT) (envelope-from jhb@FreeBSD.org) Received: from mv.twc.weather.com (mv.twc.weather.com [65.212.71.225]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3B4E743D45; Mon, 12 Sep 2005 22:03:31 +0000 (GMT) (envelope-from jhb@FreeBSD.org) Received: from [10.50.41.233] (Not Verified[10.50.41.233]) by mv.twc.weather.com with NetIQ MailMarshal (v6, 0, 3, 8) id ; Mon, 12 Sep 2005 18:19:01 -0400 From: John Baldwin To: Brooks Davis Date: Mon, 12 Sep 2005 15:51:45 -0400 User-Agent: KMail/1.8 References: <200509081350.j88DoG5s039090@repoman.freebsd.org> <200509121451.15539.jhb@FreeBSD.org> <20050912190353.GC24946@odin.ac.hmc.edu> In-Reply-To: <20050912190353.GC24946@odin.ac.hmc.edu> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-6" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200509121551.47351.jhb@FreeBSD.org> Cc: cvs-src@FreeBSD.org, src-committers@FreeBSD.org, cvs-all@FreeBSD.org, Ken Smith Subject: Re: cvs commit: src/sys/dev/hme if_hme.c X-BeenThere: cvs-src@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: CVS commit messages for the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Sep 2005 22:03:32 -0000 On Monday 12 September 2005 03:03 pm, Brooks Davis wrote: > On Mon, Sep 12, 2005 at 02:51:14PM -0400, John Baldwin wrote: > > On Thursday 08 September 2005 09:50 am, Ken Smith wrote: > > > kensmith 2005-09-08 13:50:16 UTC > > > > > > FreeBSD src repository > > > > > > Modified files: > > > sys/dev/hme if_hme.c > > > Log: > > > Move hme_stop() after ether_ifdetach() and if_free() to prevent a > > > memory-referenced-after-free panic if the hme interface fails to > > > attach. > > > > > > Patch obtained from: marius > > > Suggested same thing: brooks > > > > > > MFC after: 3 days > > > > Umm, can't this lead to panics due to hme_intr() dereferencing sc_ifp? > > Why not do what all the other ethernet drivers do: > > > > if (device_is_attached(dev)) { > > HME_LOCK(sc); > > hme_stop(sc); > > HME_UNLOCK(sc); > > callout_drain(..); > > ether_ifdetach(...); > > if_free(...); > > } > > > > For references of similar drivers look at the detach methods for xl(4), > > pcn(4), wb(4), dc(4), sf(4), etc. > > The commit message is backwards. It's actually correcting this bug (I > think Ken sent a followup). Ah, that's what I get for trusting the commit message. However, while writing the e-mail I did find that rl(4) was busted, so I've gone and fixed it so at least that part was productive. :) -- John Baldwin <>< http://www.FreeBSD.org/~jhb/ "Power Users Use the Power to Serve" = http://www.FreeBSD.org