cvs commit: src/sys/dev/an if_an.c src/sys/dev/arl if_arl_isa.c src/sys/dev/awi if_awi_pccard.c src/sys/dev/cm if_cm_isa.c src/sys/dev/cnw if_cnw.c src/sys/dev/cp if_cp.c src/sys/dev/cs if_cs.c src/sys/dev/ed if_ed.c src/sys/dev/em if_em.c ...

[M. Warner Losh]

In message: <20050919055028.GC65954 at ip.net.ua>
            Ruslan Ermilov <ru at freebsd.org> writes:
: Hi,
: 
: On Mon, Sep 19, 2005 at 03:10:21AM +0000, Warner Losh wrote:
: > imp         2005-09-19 03:10:21 UTC
: > 
: >   FreeBSD src repository
: > 
: >   Modified files:
: >     sys/dev/an           if_an.c 
: [...]
: >     sys/dev/xe           if_xe_pccard.c 
: >   Log:
: >   Make sure that we call if_free(ifp) after bus_teardown_intr.  Since we
: >   could get an interrupt after we free the ifp, and the interrupt
: >   handler depended on the ifp being still alive, this could, in theory,
: >   cause a crash.  Eliminate this possibility by moving the if_free to
: >   after the bus_teardown_intr() call.
: >   
: I'm going into more details in my other reply to your ed(4) commit,
: but I'm pretty sure you're attacking a wrong problem here.  Most
: drivers don' assume and will behave badly (read: panic) if foo_intr()
: is called after foo_stop() (foo_stop() disables interrupts and
: usually frees some resources needed by code called from foo_intr()).
: A better fix that I had in mind (and that I think jhb@ has suggested)
: would be to return from foo_intr() quickly if IFF_DRV_RUNNING is not
: set.  Can you reproduce the problem that you mention on real hardware?

You can't test IFF_DRV_RUNNING in memory that's already been freed.

Warner