Re: kern/48105: panic at shutdown from NULL pointer dereference causedby virtio_detach()

[Izumi Tsutsui <tsutsui%ceres.dti.ne.jp@localhost>]

The following reply was made to PR kern/48105; it has been noted by GNATS.

From: Izumi Tsutsui <tsutsui%ceres.dti.ne.jp@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: rhansen%bbn.com@localhost, tsutsui%ceres.dti.ne.jp@localhost
Subject: Re: kern/48105: panic at shutdown from NULL pointer dereference 
causedby
         virtio_detach()
Date: Fri, 9 Aug 2013 20:12:56 +0900

 Ah, I'm a bit stupid.
 Your first analysis seems correct and it's enough to add a check
 sc->sc_ih != NULL in a detach function.
 Could you confirm the following patch?
 
 Index: virtio.c
 ===================================================================
 RCS file: /cvsroot/src/sys/dev/pci/virtio.c,v
 retrieving revision 1.3
 diff -u -p -r1.3 virtio.c
 --- virtio.c   2 Nov 2011 23:05:52 -0000       1.3
 +++ virtio.c   9 Aug 2013 11:12:18 -0000
 @@ -199,8 +199,10 @@ virtio_detach(device_t self, int flags)
        }
        KASSERT(sc->sc_child == 0 || sc->sc_child == (void*)1);
        KASSERT(sc->sc_vqs == 0);
 -      pci_intr_disestablish(sc->sc_pc, sc->sc_ih);
 -      sc->sc_ih = 0;
 +      if (sc->sc_ih != NULL) {
 +              pci_intr_disestablish(sc->sc_pc, sc->sc_ih);
 +              sc->sc_ih = NULL;
 +      }
        if (sc->sc_iosize)
                bus_space_unmap(sc->sc_iot, sc->sc_ioh, sc->sc_iosize);
        sc->sc_iosize = 0;
 
 ---
 
 Thanks,
 
 ---
 Izumi Tsutsui