diff options
author | Will Andrews <will@FreeBSD.org> | 2014-09-18 02:01:36 +0000 |
---|---|---|
committer | Will Andrews <will@FreeBSD.org> | 2014-09-18 02:01:36 +0000 |
commit | 1d0a1de2aa21568c05f5529ea16d57c6537beaef (patch) | |
tree | 09b1683af5da99a716bbc5f899468caf60483621 /sys/net/if_lagg.c | |
parent | 217c8381d19eeed36fedcb84f6807a1147714e2c (diff) | |
download | src-1d0a1de2aa21568c05f5529ea16d57c6537beaef.tar.gz src-1d0a1de2aa21568c05f5529ea16d57c6537beaef.zip |
Fix a kernel panic when unloading isp(4).
In the current implementation, the isp_kthread() threads never exit.
The target threads do have an exit mode from isp_attach(), but it is
not invoked from isp_detach().
Ensure isp_detach() notifies threads started for each channel, such
that they exit before their parent device softc detaches, and thus
before the module does. Otherwise, a page fault panic occurs later in:
sysctl_kern_proc
sysctl_out_proc
kern_proc_out
fill_kinfo_proc
fill_kinfo_thread
strlcpy(kp->ki_wmesg, td->td_wmesg, sizeof(kp->ki_wmesg));
For isp_kthread() (and isp(4) target threads), td->td_wmesg references
now-unmapped memory after the module has been unloaded. These threads
are typically msleep()ing at the time of unload, but they could also
attempt to execute now-unmapped code segments.
MFC after: 1 month
Sponsored by: Spectra Logic
MFSpectraBSD: r1070921 on 2014/06/22 13:01:17
Notes
Notes:
svn path=/head/; revision=271731
Diffstat (limited to 'sys/net/if_lagg.c')
0 files changed, 0 insertions, 0 deletions