From dan@kulesh.obluda.cz  Sun Dec 16 02:28:04 2007
Return-Path: <dan@kulesh.obluda.cz>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 7C4ED16A41A
	for <FreeBSD-gnats-submit@freebsd.org>; Sun, 16 Dec 2007 02:28:04 +0000 (UTC)
	(envelope-from dan@kulesh.obluda.cz)
Received: from smtp1.kolej.mff.cuni.cz (smtp1.kolej.mff.cuni.cz [78.128.192.4])
	by mx1.freebsd.org (Postfix) with ESMTP id 1F1BF13C461
	for <FreeBSD-gnats-submit@freebsd.org>; Sun, 16 Dec 2007 02:28:03 +0000 (UTC)
	(envelope-from dan@kulesh.obluda.cz)
Received: from kulesh.obluda.cz (openvpn.ms.mff.cuni.cz [195.113.20.87])
	by smtp1.kolej.mff.cuni.cz (8.13.8/8.13.8) with ESMTP id lBG2Rkd7067756
	for <FreeBSD-gnats-submit@freebsd.org>; Sun, 16 Dec 2007 03:27:50 +0100 (CET)
	(envelope-from dan@kulesh.obluda.cz)
Received: from kulesh.obluda.cz (localhost. [127.0.0.1])
	by kulesh.obluda.cz (8.14.2/8.14.2) with ESMTP id lBG2RhfV001202
	for <FreeBSD-gnats-submit@freebsd.org>; Sun, 16 Dec 2007 03:27:43 +0100 (CET)
	(envelope-from dan@kulesh.obluda.cz)
Received: (from root@localhost)
	by kulesh.obluda.cz (8.14.2/8.14.1/Submit) id lBG2RhFn001201;
	Sun, 16 Dec 2007 03:27:43 +0100 (CET)
	(envelope-from dan)
Message-Id: <200712160227.lBG2RhFn001201@kulesh.obluda.cz>
Date: Sun, 16 Dec 2007 03:27:43 +0100 (CET)
From: Dan Lukes <dan@obluda.cz>
Reply-To: Dan Lukes <dan@obluda.cz>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: [ PATCH ] Panic due double free within detach of cpufreq/est
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         118737
>Category:       kern
>Synopsis:       [cpufreq] [patch] Panic due double free within detach of cpufreq/est
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    jhb
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Dec 16 02:30:00 UTC 2007
>Closed-Date:    Mon Sep 29 15:46:55 UTC 2008
>Last-Modified:  Mon Sep 29 15:46:55 UTC 2008
>Originator:     Dan Lukes
>Release:        FreeBSD 6.3-PRERELEASE i386
>Organization:
Obludarium
>Environment:
System: FreeBSD 6.3-PRERELEASE #18: Sun Dec 16 03:05:00 CET 2007 i386
src/sys/i386/cpufreq/est.c,v 1.7.2.1 2006/05/29 22:40:03 njl

As far as I know the problem apply to CURRENT as well

>Description:

  on est_detach the sc->freq_list freed but driver cease to detach (ENXIO)

  on second try to unload driver the memory is freed second time causing
the panic()

>How-To-Repeat:
	On hardware supported by est driver unload cpufreq module - it fail with ENXIO
	unload it second time - it will panic

>Fix:

	Unregister the driver properly then return NOERROR to upper layer.

--- sys/i386/cpufreq/est.c.ORIG	2007-12-16 02:13:42.000000000 +0100
+++ sys/i386/cpufreq/est.c	2007-12-16 02:26:46.000000000 +0100
@@ -1032,11 +1032,14 @@
 est_detach(device_t dev)
 {
 	struct est_softc *sc;
+	int error;
 
 	sc = device_get_softc(dev);
-	if (sc->acpi_settings)
+
+	error = cpufreq_unregister(dev);
+	if (!error && sc->acpi_settings)
 		free(sc->freq_list, M_DEVBUF);
-	return (ENXIO);
+	return (error);
 }
 
 /*


>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-i386->freebsd-bugs 
Responsible-Changed-By: remko 
Responsible-Changed-When: Sun Dec 23 17:23:41 UTC 2007 
Responsible-Changed-Why:  
I think this should not be in the i386 group but globally in the -bugs 
list 

http://www.freebsd.org/cgi/query-pr.cgi?pr=118737 
State-Changed-From-To: open->patched 
State-Changed-By: jhb 
State-Changed-When: Wed Sep 10 23:00:16 UTC 2008 
State-Changed-Why:  
Oops, forgot to credit this PR when committing a similar fix to HEAD 
today. 


Responsible-Changed-From-To: freebsd-bugs->jhb 
Responsible-Changed-By: jhb 
Responsible-Changed-When: Wed Sep 10 23:00:16 UTC 2008 
Responsible-Changed-Why:  
Oops, forgot to credit this PR when committing a similar fix to HEAD 
today. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=118737 
State-Changed-From-To: patched->closed 
State-Changed-By: jhb 
State-Changed-When: Mon Sep 29 15:46:10 UTC 2008 
State-Changed-Why:  
Fix merged to 7.x. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=118737 
>Unformatted:
