ucom panic

YONETANI Tomokazu qhwt+dragonfly-bugs at les.ath.cx
Thu May 27 04:16:28 PDT 2004


Hello.
After the device layer rollup commit, ucom driver panics when
I disconnect from a tip(1) session. Attached is the backtrace
from the panic. The problem is that ucomclose() is releasing
tp->t_dev too early, and ucomstop() passes it to minor()
without chacking the value, resulting in a NULL-pointer dereference.
I'm not sure how to fix this, but I think you have to push down
the following block in usbclose()

	if (tp->t_dev) {
		release_dev(tp->t_dev);
		tp->t_dev = NULL;
	}

down to somewhere after the label `quit:'.
Attachment:
crash.txt.gz
-------------- next part --------------
A non-text attachment was scrubbed...
Name: bin00001.bin
Type: application/octet-stream
Size: 1840 bytes
Desc: "Description: application/gunzip"
URL: <http://lists.dragonflybsd.org/pipermail/bugs/attachments/20040527/d85fa1e5/attachment-0017.bin>


More information about the Bugs mailing list