[PATCH] ugen detach race

[Anish Mistry]

On Wednesday 05 April 2006 03:53, Anish Mistry wrote:
> 	While working on getting hplip ported I ran across a race
> condition in the ugen code that causes a crash.  The following
> patch fixes a problem where read, write, and ioctl can be called
> during a detach since sc_dying isn't checked before bumping the
> reference count. This puts the sc_dying check before the *_do_*
> functions are called. This includes the patch from usb/81308 to
> prevent polling on the control endpoint.  As well as a few NULL
> pointer checks from NetBSD. This patch is applicable to RELENG_6.
And CURRENT.

> http://am-productions.biz/docs/ugen-detach-race.patch
>
> This doesn't fix the case where an application has a read/write
> pending and then detach is called.  In this case destroy_devl will
> just keep looping until the read/write completes.

-- 
Anish Mistry
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-current/attachments/20060405/3db6a442/attachment.pgp