device driver memory leak in 5.1-20030726?

John-Mark Gurney gurney_j at
Mon Jul 28 12:52:08 PDT 2003

Gary Jennejohn wrote this message on Mon, Jul 28, 2003 at 12:58 +0200:
> It appears to me that the test in usb_block_allocmem() should be
> (p->tag->parent == tag || p->tag->parent == tag->parent) and NOT
> p->tag == tag! That's because bus_dma_tag_create() uses the tag
> passed into usb_block_allocmem() as newtag->parent!
> Unfortunately, bus_dma_tag is an opaque type and there's no way to
> access the parent member anywhere but in the MD busdma_machdep.c :-(
> Anyway, as written there's no way that I can see that the code can
> work correctly.

You miss the code in the XXX bit that overrides the tag with the tag
passed in.  If we allocate a fullblock, the tag doesn't need to be
overwriten since we end up freeing it, but in the fragment case, we
override the tag, and we don't need to keep the tag allocated by
usb_block_allocmem since we never end up freeing the block that is
part of the fragments.

The bug fixed in rev1.2 was because of a difference in how NetBSD/OpenBSD
handles things.  We wouldn't need this if we had a size parameter to

Please reread the code and see what I mean.

  John-Mark Gurney				Voice: +1 415 225 5579

     "All that I will do, has been done, All that I have, has not."

More information about the freebsd-current mailing list