usb/80777: usb_rem_task() should wait for callback to complete
Hans Petter Selasky
hselasky at c2i.net
Sun May 8 06:50:09 PDT 2005
>Number: 80777
>Category: usb
>Synopsis: usb_rem_task() should wait for callback to complete?
>Confidential: no
>Severity: critical
>Priority: medium
>Responsible: freebsd-usb
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Sun May 08 13:50:07 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator: HPS
>Release: FreeBSD 6.0-CURRENT i386
>Organization:
>Environment:
System: FreeBSD 6.0-CURRENT FreeBSD 6.0-CURRENT #45: Mon Mar 21 15:40:17 CET
2005 root@:/usr/obj/usr/src/sys/custom i386
>Description:
In the file "/sys/dev/usb/usb.c", the function "usb_rem_task" should wait for
the "usb_task_thread()" to finish execution of the callback function. Though
this might be impossible due to the contexts from which this function is
called. At least one place (see if_udav.c) "usb_rem_task" is called from
detach, and the code expects that the callback has returned or is not called,
after that "usb_rem_task" returns. Else the callback will access freed
memory.
>How-To-Repeat:
>Fix:
Maybe "usb_xxxx_task" should not be used by if_udav.c, like suggested
in another PR?
>Release-Note:
>Audit-Trail:
>Unformatted:
More information about the freebsd-usb
mailing list