These cam_sim_alloc() calls seem to be fairly critical to the operation
of DPT and friends, why is it even possible for them to return NULL
in the first place and what would be the effect of a (properly handled)
NULL return if it did occur at this point?
-Matt
Matthew Dillon
<[EMAIL PROTECTED]>
:> > * Create the device queue for our SIM.
:> > */
:> > Start --->
:> > devq =3D cam_simq_alloc(dpt->max_dccbs);
:> >=20
:...
:> Index: dpt_scsi.c
:> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
:=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
:=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
:> RCS file: /home/ncvs/src/sys/dev/dpt/dpt_scsi.c,v
:> retrieving revision 1.45
:> diff -u -p -r1.45 dpt_scsi.c
:> --- dpt_scsi.c 24 Aug 2003 17:46:04 -0000 1.45
:> +++ dpt_scsi.c 18 Jan 2004 15:39:13 -0000
:> @@ -1553,6 +1553,8 @@ dpt_attach(dpt_softc_t *dpt)
:> dpt->sims[i] =3D cam_sim_alloc(dpt_action, dpt_poll, "dpt",
:> dpt, dpt->unit, /*untagged*/2,
:> /*tagged*/dpt->max_dccbs, devq);
:> + if (dpt->sims[i] =3D=3D NULL)
:> + break;
:> if (xpt_bus_register(dpt->sims[i], i) !=3D CAM_SUCCESS) {
:> cam_sim_free(dpt->sims[i], /*free_devq*/i =3D=3D 0);
:> break;
:> %%%
:>=20
:Bah, but with this patch that avoids the NULL pointer dereference
:we start leaking devq. Attached is a more complete patch, and for
:dev/irr/irr.c too.
:
:
:Cheers,
:--=20
:Ruslan Ermilov
:FreeBSD committer
:[EMAIL PROTECTED]
:
:--yLVHuoLXiP9kZBkt
:Content-Type: text/plain; charset=us-ascii
:Content-Disposition: attachment; filename=p
:
:Index: dpt/dpt_scsi.c
:===================================================================
:RCS file: /home/ncvs/src/sys/dev/dpt/dpt_scsi.c,v
:retrieving revision 1.45
:diff -u -p -r1.45 dpt_scsi.c
:--- dpt/dpt_scsi.c 24 Aug 2003 17:46:04 -0000 1.45
:+++ dpt/dpt_scsi.c 18 Jan 2004 15:51:44 -0000
:@@ -1553,6 +1553,11 @@ dpt_attach(dpt_softc_t *dpt)
: dpt->sims[i] = cam_sim_alloc(dpt_action, dpt_poll, "dpt",
: dpt, dpt->unit, /*untagged*/2,
: /*tagged*/dpt->max_dccbs, devq);
:+ if (dpt->sims[i] == NULL) {
:+ if (i == 0)
:+ cam_simq_free(devq);
:+ break;
:+ }
: if (xpt_bus_register(dpt->sims[i], i) != CAM_SUCCESS) {
: cam_sim_free(dpt->sims[i], /*free_devq*/i == 0);
: break;
:Index: iir/iir.c
:===================================================================
:RCS file: /home/ncvs/src/sys/dev/iir/iir.c,v
:retrieving revision 1.9
:diff -u -p -r1.9 iir.c
:--- iir/iir.c 26 Sep 2003 15:36:47 -0000 1.9
:+++ iir/iir.c 18 Jan 2004 15:52:04 -0000
:@@ -510,6 +510,11 @@ iir_attach(struct gdt_softc *gdt)
: gdt->sims[i] = cam_sim_alloc(iir_action, iir_poll, "iir",
: gdt, gdt->sc_hanum, /*untagged*/2,
: /*tagged*/GDT_MAXCMDS, devq);
:+ if (gdt->sims[i] == NULL) {
:+ if (i == 0)
:+ cam_simq_free(devq);
:+ break;
:+ }
: if (xpt_bus_register(gdt->sims[i], i) != CAM_SUCCESS) {
: cam_sim_free(gdt->sims[i], /*free_devq*/i == 0);
: break;
:
:--yLVHuoLXiP9kZBkt--
:
:--SO98HVl1bnMOfKZd
:Content-Type: application/pgp-signature
:Content-Disposition: inline
:
:-----BEGIN PGP SIGNATURE-----
:Version: GnuPG v1.2.4 (FreeBSD)
:
:iD8DBQFACq9iUkv4P6juNwoRAghWAKCBpqGJmtW1g7vOJS15YgKfg/782QCeImr/
:aZ5eUYh2kvOaSBl5zcFd4mE=
:=j+I+
:-----END PGP SIGNATURE-----
_______________________________________________
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
