cvs commit: src/sys/dev/hme if_hme.c

[John Baldwin]

On Monday 12 September 2005 03:03 pm, Brooks Davis wrote:
> On Mon, Sep 12, 2005 at 02:51:14PM -0400, John Baldwin wrote:
> > On Thursday 08 September 2005 09:50 am, Ken Smith wrote:
> > > kensmith    2005-09-08 13:50:16 UTC
> > >
> > >   FreeBSD src repository
> > >
> > >   Modified files:
> > >     sys/dev/hme          if_hme.c
> > >   Log:
> > >   Move hme_stop() after ether_ifdetach() and if_free() to prevent a
> > >   memory-referenced-after-free panic if the hme interface fails to
> > >   attach.
> > >
> > >   Patch obtained from:    marius
> > >   Suggested same thing:   brooks
> > >
> > >   MFC after:      3 days
> >
> > Umm, can't this lead to panics due to hme_intr() dereferencing sc_ifp? 
> > Why not do what all the other ethernet drivers do:
> >
> > 	if (device_is_attached(dev)) {
> > 		HME_LOCK(sc);
> > 		hme_stop(sc);
> > 		HME_UNLOCK(sc);
> > 		callout_drain(..);
> > 		ether_ifdetach(...);
> > 		if_free(...);
> > 	}
> >
> > For references of similar drivers look at the detach methods for xl(4),
> > pcn(4), wb(4), dc(4), sf(4), etc.
>
> The commit message is backwards.  It's actually correcting this bug (I
> think Ken sent a followup).

Ah, that's what I get for trusting the commit message.  However, while writing 
the e-mail I did find that rl(4) was busted, so I've gone and fixed it so at 
least that part was productive. :)

-- 
John Baldwin <jhb at FreeBSD.org>  <><  http://www.FreeBSD.org/~jhb/
"Power Users Use the Power to Serve"  =  http://www.FreeBSD.org