svn commit: r190666 - in stable/7/sys: . contrib/pf dev/ath/ath_hal dev/cxgb dev/malo

[Weongyo Jeong]

Author: weongyo
Date: Fri Apr  3 03:25:00 2009
New Revision: 190666
URL: http://svn.freebsd.org/changeset/base/190666

Log:
  MFC r190541:
    fix a bug of uses after free.
  
    Pointed by:	dchagin
  
  MFC r190544:
    handles more exceptional cases when the driver failed to attach.
  
  MFC r190550:
    corrects a error message.
  
  MFC r190590:
    fix a bug that it passed a incorrect flag BUS_DMA_ALLOCNOW to create
    a device specific DMA tag. On amd64 it could exhaust all of bounce
    pages when bus_dma_tag_create(9) is called at malo_pci_attach() then
    as result in next turn it returns ENOMEM. This fix a attach fail on
    amd64.
  
    Pointed by:   yongari
    Tested by:    dchagin
  
  Approved by:	re (kib)

Modified:
  stable/7/sys/   (props changed)
  stable/7/sys/contrib/pf/   (props changed)
  stable/7/sys/dev/ath/ath_hal/   (props changed)
  stable/7/sys/dev/cxgb/   (props changed)
  stable/7/sys/dev/malo/if_malo_pci.c
  stable/7/sys/dev/malo/if_malohal.c

Modified: stable/7/sys/dev/malo/if_malo_pci.c
==============================================================================
--- stable/7/sys/dev/malo/if_malo_pci.c	Fri Apr  3 03:04:26 2009	(r190665)
+++ stable/7/sys/dev/malo/if_malo_pci.c	Fri Apr  3 03:25:00 2009	(r190666)
@@ -245,7 +245,7 @@ malo_pci_attach(device_t dev)
 			       BUS_SPACE_MAXADDR,	/* maxsize */
 			       0,			/* nsegments */
 			       BUS_SPACE_MAXADDR,	/* maxsegsize */
-			       BUS_DMA_ALLOCNOW,	/* flags */
+			       0,			/* flags */
 			       NULL,			/* lockfunc */
 			       NULL,			/* lockarg */
 			       &sc->malo_dmat)) {
@@ -260,12 +260,13 @@ malo_pci_attach(device_t dev)
 
 	error = malo_attach(pci_get_device(dev), sc);
 
-	if (error != 0) {
-		malo_pci_detach(dev);
-		return (error);
-	}
+	if (error != 0)
+		goto bad2;
 
 	return (error);
+
+bad2:
+	bus_dma_tag_destroy(sc->malo_dmat);
 bad1:
 	if (psc->malo_msi == 0)
 		bus_teardown_intr(dev, psc->malo_res_irq[0],
@@ -275,10 +276,11 @@ bad1:
 			bus_teardown_intr(dev, psc->malo_res_irq[i],
 			    psc->malo_intrhand[i]);
 	}
-
+	bus_release_resources(dev, psc->malo_irq_spec, psc->malo_res_irq);
 bad:
 	if (psc->malo_msi != 0)
 		pci_release_msi(dev);
+	bus_release_resources(dev, psc->malo_mem_spec, psc->malo_res_mem);
 
 	return (error);
 }

Modified: stable/7/sys/dev/malo/if_malohal.c
==============================================================================
--- stable/7/sys/dev/malo/if_malohal.c	Fri Apr  3 03:04:26 2009	(r190665)
+++ stable/7/sys/dev/malo/if_malohal.c	Fri Apr  3 03:25:00 2009	(r190666)
@@ -128,7 +128,7 @@ malo_hal_attach(device_t dev, uint16_t d
 		       NULL,			/* lockarg */
 		       &mh->mh_dmat);
 	if (error != 0) {
-		device_printf(dev, "unable to allocate memory for cmd buffer, "
+		device_printf(dev, "unable to allocate memory for cmd tag, "
 			"error %u\n", error);
 		goto fail;
 	}
@@ -163,8 +163,6 @@ malo_hal_attach(device_t dev, uint16_t d
 	return (mh);
 
 fail:
-	free(mh, M_DEVBUF);
-
 	if (mh->mh_dmamap != NULL) {
 		bus_dmamap_unload(mh->mh_dmat, mh->mh_dmamap);
 		if (mh->mh_cmdbuf != NULL)
@@ -174,6 +172,7 @@ fail:
 	}
 	if (mh->mh_dmat)
 		bus_dma_tag_destroy(mh->mh_dmat);
+	free(mh, M_DEVBUF);
 
 	return (NULL);
 }