Module Name: src
Committed By: drochner
Date: Mon May 16 10:53:20 UTC 2011
Modified Files:
src/sys/dev/usb: uvideo.c
Log Message:
fix detach() to avoid use-after-free problems:
-stop transfers before freeing data structures
(and comment out a useless delay)
-free devinfo later
Hot-unplugging an USB cam while in use doesn't crash my box anymore now.
To generate a diff of this commit:
cvs rdiff -u -r1.33 -r1.34 src/sys/dev/usb/uvideo.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/usb/uvideo.c
diff -u src/sys/dev/usb/uvideo.c:1.33 src/sys/dev/usb/uvideo.c:1.34
--- src/sys/dev/usb/uvideo.c:1.33 Fri Dec 24 20:54:28 2010
+++ src/sys/dev/usb/uvideo.c Mon May 16 10:53:19 2011
@@ -1,4 +1,4 @@
-/* $NetBSD: uvideo.c,v 1.33 2010/12/24 20:54:28 jmcneill Exp $ */
+/* $NetBSD: uvideo.c,v 1.34 2011/05/16 10:53:19 drochner Exp $ */
/*
* Copyright (c) 2008 Patrick Mahoney
@@ -42,7 +42,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: uvideo.c,v 1.33 2010/12/24 20:54:28 jmcneill Exp $");
+__KERNEL_RCSID(0, "$NetBSD: uvideo.c,v 1.34 2011/05/16 10:53:19 drochner Exp $");
#ifdef _MODULE
#include <sys/module.h>
@@ -671,20 +671,21 @@
pmf_device_deregister(self);
- usbd_devinfo_free(sc->sc_devname);
-
/* TODO: close the device if it is currently opened? Or will
* close be called automatically? */
while (!SLIST_EMPTY(&sc->sc_stream_list)) {
vs = SLIST_FIRST(&sc->sc_stream_list);
SLIST_REMOVE_HEAD(&sc->sc_stream_list, entries);
+ uvideo_stream_stop_xfer(vs);
uvideo_stream_free(vs);
}
+#if 0
/* Wait for outstanding request to complete. TODO: what is
* appropriate here? */
usbd_delay_ms(sc->sc_udev, 1000);
+#endif
DPRINTFN(15, ("uvideo: detaching from %s\n",
device_xname(sc->sc_dev)));
@@ -695,6 +696,8 @@
usbd_add_drv_event(USB_EVENT_DRIVER_DETACH, sc->sc_udev,
sc->sc_dev);
+ usbd_devinfo_free(sc->sc_devname);
+
return rv;
}
