Page MenuHomeFreeBSD

firewire: NULL check on malloc in fw_busreset()
ClosedPublic

Authored by guest-seuros on Jun 21 2026, 8:21 PM.
Referenced Files
Unknown Object (File)
Thu, Jul 16, 9:42 AM
Unknown Object (File)
Thu, Jul 16, 3:56 AM
Unknown Object (File)
Wed, Jul 15, 5:31 PM
Unknown Object (File)
Wed, Jul 15, 5:31 PM
Unknown Object (File)
Wed, Jul 15, 7:27 AM
Unknown Object (File)
Wed, Jul 15, 7:27 AM
Unknown Object (File)
Wed, Jul 15, 12:31 AM
Unknown Object (File)
Sat, Jul 4, 8:43 AM
Subscribers

Details

Summary

fw_busreset() allocates newrom with M_NOWAIT from interrupt context.
If the allocation fails, crom_load() dereferences a NULL pointer.

Skip the config ROM comparison on allocation failure so the next bus
reset will retry.

Test Plan

Hard to reproduce reliably. Triggered by wiggling the cable on a
battery-powered FireWire camera, the intermittent connection causes
rapid bus resets that race with allocation, eventually hitting the
NULL path. Panic no longer occurs with the fix.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable