Re: if_bge.c callout freed before allocation

[Emmanuel Dreyfus <manu%netbsd.org@localhost>]

On Tue, May 06, 2025 at 03:12:33PM +1000, matthew green wrote:
> seems like it would be simpler to simply move the callout_init earlier.
> bge_flags also seems like h/w features, putting this in there seems
> like, while it uses a spare bit, is the wrong place anyway, but i think
> we can simply avoid it by moving the callout_init() earlier.

Looking at it, I suspect there is another bug lurking. 
bge_attach() has 14 places where it can return without
reeaching the end.

1. failed to enable memory mapping!
2. can't find mem space
3. couldn't map BAR2 memory (in #if 0)
4. couldn't map BAR2 memory
5. couldn't map BAR2 memory
6. couldn't alloc interrupt
7. couldn't establish interrupt
8. unable to create reset workqueue
9. chip initialization failed 
10. failed to read station address
11. can't alloc rx buffers
12. can't map DMA buffers 
13. can't create DMA map
14. (no message)

bge_release_resources() is only called in cases 9 and 10. 
Currently callout_init() is done after case 14. It seems it
should be moved between cases 8 and 9, but cases 11 to 14 do 
not call bge_release_resources(), which means the callout 
will not be freed. Is bge_release_resources()  missing there? 


-- 
Emmanuel Dreyfus
manu%netbsd.org@localhost