cvs commit: src/sys/dev/hme if_hme.c

[Brooks Davis]

On Mon, Sep 12, 2005 at 02:51:14PM -0400, John Baldwin wrote:
> On Thursday 08 September 2005 09:50 am, Ken Smith wrote:
> > kensmith    2005-09-08 13:50:16 UTC
> >
> >   FreeBSD src repository
> >
> >   Modified files:
> >     sys/dev/hme          if_hme.c
> >   Log:
> >   Move hme_stop() after ether_ifdetach() and if_free() to prevent a
> >   memory-referenced-after-free panic if the hme interface fails to
> >   attach.
> >
> >   Patch obtained from:    marius
> >   Suggested same thing:   brooks
> >
> >   MFC after:      3 days
> 
> Umm, can't this lead to panics due to hme_intr() dereferencing sc_ifp?  Why 
> not do what all the other ethernet drivers do:
> 
> 	if (device_is_attached(dev)) {
> 		HME_LOCK(sc);
> 		hme_stop(sc);
> 		HME_UNLOCK(sc);
> 		callout_drain(..);
> 		ether_ifdetach(...);
> 		if_free(...);
> 	}
> 
> For references of similar drivers look at the detach methods for xl(4), 
> pcn(4), wb(4), dc(4), sf(4), etc.

The commit message is backwards.  It's actually correcting this bug (I
think Ken sent a followup).

-- Brooks

-- 
Any statement of the form "X is the one, true Y" is FALSE.
PGP fingerprint 655D 519C 26A7 82E7 2529  9BF0 5D8E 8BE9 F238 1AD4
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/cvs-all/attachments/20050912/4bf0f6a6/attachment.bin