Re: PR/44907 CVS commit: src/sys/dev/usb

[Gordon McNutt <gmcnutt%cradlepoint.com@localhost>]

The following reply was made to PR kern/44907; it has been noted by GNATS.

From: Gordon McNutt <gmcnutt%cradlepoint.com@localhost>
To: "gnats-bugs%NetBSD.org@localhost" <gnats-bugs%NetBSD.org@localhost>
Cc: 
Subject: Re: PR/44907 CVS commit: src/sys/dev/usb
Date: Wed, 1 Jun 2011 17:19:18 -0600

 I haven't seen this on our systems, but I wonder if Paul's crash was due 
 to deref'ing a NULL pipe on this line:
 
        usb_rem_task(xfer->pipe->device, &exfer->abort_task);
 
 Looking up his call stack at usbd_free_xfer it looks like xfer->device 
 should be a usable substitute. The arg is not even used in usb_rem_task() 
 in current code.
 
 On Fri, 27 May 2011, Izumi Tsutsui wrote:
 
 >
 > The following reply was made to PR kern/44907; it has been noted by GNATS.
 >
 > From: "Izumi Tsutsui" <tsutsui%netbsd.org@localhost>
 > To: gnats-bugs%gnats.NetBSD.org@localhost
 > Cc:
 > Subject: PR/44907 CVS commit: src/sys/dev/usb
 > Date: Fri, 27 May 2011 19:04:25 +0000
 >
 > Module Name: src
 > Committed By:        tsutsui
 > Date:                Fri May 27 19:04:24 UTC 2011
 >
 > Modified Files:
 >      src/sys/dev/usb: ehci.c ohci.c ohcivar.h uhci.c
 >
 > Log Message:
 > Apply patch in PR kern/44907 (crash due to race in ehci.c):
 >  - make sure to remove abort_task in ehci_freex
 >  - always initialize abort_task in ehci_allocx,
 >    not in ehci_timeout just before adding the task
 > Also apply similar fixes to ohci and uhci.
 >
 > XXX: should we also call abort_task handler before removing it from queue
 >      if *hci_freex() is called for usbd_xfer_handle with queued abort_task?
 >
 >
 > To generate a diff of this commit:
 > cvs rdiff -u -r1.175 -r1.176 src/sys/dev/usb/ehci.c
 > cvs rdiff -u -r1.212 -r1.213 src/sys/dev/usb/ohci.c
 > cvs rdiff -u -r1.49 -r1.50 src/sys/dev/usb/ohcivar.h
 > cvs rdiff -u -r1.236 -r1.237 src/sys/dev/usb/uhci.c
 >
 > Please note that diffs are not public domain; they are subject to the
 > copyright notices on the relevant files.
 >
 >
 > !SIG:4ddff5e5127751999567911!
 >
 >