Page MenuHomeFreeBSD

firewire: NULL check on malloc in fw_busreset()
ClosedPublic

Authored by guest-seuros on Jun 21 2026, 8:21 PM.
Referenced Files
F166664438: D57728.diff
Sat, Aug 15, 8:48 AM
F166664418: D57728.diff
Sat, Aug 15, 8:48 AM
Unknown Object (File)
Fri, Aug 14, 11:43 AM
Unknown Object (File)
Thu, Aug 13, 9:14 PM
Unknown Object (File)
Tue, Aug 11, 7:14 PM
Unknown Object (File)
Sun, Aug 9, 4:24 PM
Unknown Object (File)
Fri, Aug 7, 6:14 PM
Unknown Object (File)
Mon, Aug 3, 3:20 PM
Subscribers

Details

Summary

fw_busreset() allocates newrom with M_NOWAIT from interrupt context.
If the allocation fails, crom_load() dereferences a NULL pointer.

Skip the config ROM comparison on allocation failure so the next bus
reset will retry.

Test Plan

Hard to reproduce reliably. Triggered by wiggling the cable on a
battery-powered FireWire camera, the intermittent connection causes
rapid bus resets that race with allocation, eventually hitting the
NULL path. Panic no longer occurs with the fix.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable