fw_busreset() allocates newrom with M_NOWAIT from interrupt context.
If the allocation fails, crom_load() dereferences a NULL pointer.
Skip the config ROM comparison on allocation failure so the next bus
reset will retry.
Details
Details
- Reviewers
adrian - Group Reviewers
firewire - Commits
- rG51f4e90ce7ef: firewire: NULL check on malloc in fw_busreset()
Hard to reproduce reliably. Triggered by wiggling the cable on a
battery-powered FireWire camera, the intermittent connection causes
rapid bus resets that race with allocation, eventually hitting the
NULL path. Panic no longer occurs with the fix.
Diff Detail
Diff Detail
- Repository
- rG FreeBSD src repository
- Lint
Lint Passed - Unit
No Test Coverage - Build Status
Buildable 74085 Build 70968: arc lint + arc unit