kern/46658: wpi panics on `ifconfig wpi0 up' if firmware fails to load

[Taylor R Campbell <campbell+netbsd%mumble.net@localhost>]

>Number:         46658
>Category:       kern
>Synopsis:       wpi panics on `ifconfig wpi0 up' if firmware fails to load
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Jul 05 01:25:00 +0000 2012
>Originator:     Taylor R Campbell <campbell+netbsd%mumble.net@localhost>
>Release:        NetBSD 6.99.7
>Organization:
>Environment:
>Description:

        If the firmware is not handy, `ifconfig wpi0 up' triggers a
        panic because of a broken error branch in wpi_cache_firmware.

>How-To-Repeat:

        Fail to install the firmware or render it unavailable.  Run
        `ifconfig wpi0 up'.  Curse.

>Fix:

        Apply the following patch.  OK to commit?

Index: sys/dev/pci/if_wpi.c
===================================================================
RCS file: /cvsroot/src/sys/dev/pci/if_wpi.c,v
retrieving revision 1.52
diff -p -u -r1.52 if_wpi.c
--- sys/dev/pci/if_wpi.c        2 Jun 2012 21:36:45 -0000       1.52
+++ sys/dev/pci/if_wpi.c        4 Jul 2012 17:00:17 -0000
@@ -1148,7 +1148,7 @@ wpi_cache_firmware(struct wpi_softc *sc)
        /* load firmware image from disk */
        if ((error = firmware_open("if_wpi","iwlwifi-3945.ucode", &fw)) != 0) {
                aprint_error_dev(sc->sc_dev, "could not read firmware file\n");
-               goto fail1;
+               goto fail0;
        }
 
        wpi_firmware_size = firmware_get_size(fw);
@@ -1192,8 +1192,9 @@ fail2:
        firmware_free(wpi_firmware_image, wpi_firmware_size);
 fail1:
        firmware_close(fw);
-       if (--wpi_firmware_users == 0)
-               firmware_free(wpi_firmware_image, wpi_firmware_size);
+fail0:
+       wpi_firmware_users--;
+       KASSERT(wpi_firmware_users == 0);
        mutex_exit(&wpi_firmware_mutex);
        return error;
 }