From yuri.pankov@gmail.com  Tue Dec 13 23:47:05 2011
Return-Path: <yuri.pankov@gmail.com>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id ACF631065689
	for <FreeBSD-gnats-submit@freebsd.org>; Tue, 13 Dec 2011 23:47:05 +0000 (UTC)
	(envelope-from yuri.pankov@gmail.com)
Received: from mail-ee0-f54.google.com (mail-ee0-f54.google.com [74.125.83.54])
	by mx1.freebsd.org (Postfix) with ESMTP id 3C5448FC1E
	for <FreeBSD-gnats-submit@freebsd.org>; Tue, 13 Dec 2011 23:47:04 +0000 (UTC)
Received: by eekc50 with SMTP id c50so263155eek.13
        for <FreeBSD-gnats-submit@freebsd.org>; Tue, 13 Dec 2011 15:47:04 -0800 (PST)
Received: by 10.213.6.209 with SMTP id a17mr81308eba.128.1323820023841;
        Tue, 13 Dec 2011 15:47:03 -0800 (PST)
Received: from procyon.xvoid.org ([213.132.76.142])
        by mx.google.com with ESMTPS id s16sm2685795eef.2.2011.12.13.15.47.01
        (version=TLSv1/SSLv3 cipher=OTHER);
        Tue, 13 Dec 2011 15:47:02 -0800 (PST)
Received: from procyon.xvoid.org (yuri@procyon.xvoid.org [IPv6:::1])
	by procyon.xvoid.org (8.14.5/8.14.5) with ESMTP id pBDNkxHW052218
	for <FreeBSD-gnats-submit@freebsd.org>; Wed, 14 Dec 2011 03:46:59 +0400 (MSK)
	(envelope-from yuri.pankov@gmail.com)
Received: (from yuri@localhost)
	by procyon.xvoid.org (8.14.5/8.14.5/Submit) id pBDNkxE8052217;
	Wed, 14 Dec 2011 03:46:59 +0400 (MSK)
	(envelope-from yuri.pankov@gmail.com)
Message-Id: <201112132346.pBDNkxE8052217@procyon.xvoid.org>
Date: Wed, 14 Dec 2011 03:46:59 +0400 (MSK)
From: Yuri Pankov <yuri.pankov@gmail.com>
Reply-To: Yuri Pankov <yuri.pankov@gmail.com>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: [acpi_hp] fix driver detach in absence of CMI
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         163268
>Category:       kern
>Synopsis:       [acpi_hp] [patch] fix driver detach in absence of CMI
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    jhb
>State:          patched
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Dec 13 23:50:10 UTC 2011
>Closed-Date:    
>Last-Modified:  Mon Apr 29 19:00:00 UTC 2013
>Originator:     Yuri Pankov
>Release:        FreeBSD 9.0-RC3 amd64
>Organization:
>Environment:
System: FreeBSD procyon.xvoid.org 9.0-RC3 FreeBSD 9.0-RC3 #1 r228385: Sat Dec 10 07:29:02 MSK 2011 yuri@procyon.xvoid.org:/usr/obj/data/src/freebsd/releng/9.0/sys/GENERIC amd64
>Description:
Unloading acpi_hp driver in absence of CMI (e.g., on HP Pavilion DV8, not sure if laptop doesn't have it or driver just doesn't recognize its presence, but anyway.. ) leads to "panic: sbuf_delete called with uninitialized or corrupt sbuf". We shouldn't try to free CMI-related resources if we didn't allocate them, fix logic here a bit.
>How-To-Repeat:
>Fix:
--- acpi_hp.c.diff begins here ---
Index: sys/dev/acpi_support/acpi_hp.c
===================================================================
--- sys/dev/acpi_support/acpi_hp.c	(revision 228481)
+++ sys/dev/acpi_support/acpi_hp.c	(working copy)
@@ -573,25 +573,25 @@
 static int
 acpi_hp_detach(device_t dev)
 {
-	int	ret;
-	
+	int			ret = 0;
+	struct acpi_hp_softc	*sc = device_get_softc(dev);
+
 	ACPI_FUNCTION_TRACE((char *)(uintptr_t) __func__);
-	struct acpi_hp_softc *sc = device_get_softc(dev);
-	if (sc->has_cmi && sc->hpcmi_open_pid != 0) {
-		ret = EBUSY;
-	}
-	else {
-		if (sc->has_notify) {
-			ACPI_WMI_REMOVE_EVENT_HANDLER(dev,
-			    ACPI_HP_WMI_EVENT_GUID);
+
+	if (sc->has_notify)
+		ACPI_WMI_REMOVE_EVENT_HANDLER(dev, ACPI_HP_WMI_EVENT_GUID);
+
+	if (sc->has_cmi) {
+		if (sc->hpcmi_open_pid != 0) {
+			ret = EBUSY;
+		} else {
+			if (sc->hpcmi_bufptr != -1) {
+				sbuf_delete(&sc->hpcmi_sbuf);
+				sc->hpcmi_bufptr = -1;
+			}
+			sc->hpcmi_open_pid = 0;
+			destroy_dev(sc->hpcmi_dev_t);
 		}
-		if (sc->hpcmi_bufptr != -1) {
-			sbuf_delete(&sc->hpcmi_sbuf);
-			sc->hpcmi_bufptr = -1;
-		}
-		sc->hpcmi_open_pid = 0;
-		destroy_dev(sc->hpcmi_dev_t);
-		ret = 0;
 	}
 
 	return (ret);
--- acpi_hp.c.diff ends here ---


>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->freebsd-acpi 
Responsible-Changed-By: eadler 
Responsible-Changed-When: Thu Jan 19 03:03:45 UTC 2012 
Responsible-Changed-Why:  
assign 

http://www.freebsd.org/cgi/query-pr.cgi?pr=163268 

From: hiren panchasara <hiren.panchasara@gmail.com>
To: bug-followup@FreeBSD.org, yuri.pankov@gmail.com
Cc:  
Subject: Re: kern/163268: [acpi_hp] [patch] fix driver detach in absence of CMI
Date: Mon, 8 Apr 2013 12:29:11 -0700

 I do not see any apparent problem in the proposed patch. Unfortunately
 I do not have an hp to play with.
 
 Can someone look at the patch and try or approve so that we can make
 progress on this?
 
 Thanks,
 Hiren
State-Changed-From-To: open->patched 
State-Changed-By: jhb 
State-Changed-When: Mon Apr 29 18:54:37 UTC 2013 
State-Changed-Why:  
Tweaked patch committed to HEAD, thanks! 


Responsible-Changed-From-To: freebsd-acpi->jhb 
Responsible-Changed-By: jhb 
Responsible-Changed-When: Mon Apr 29 18:54:37 UTC 2013 
Responsible-Changed-Why:  
Tweaked patch committed to HEAD, thanks! 

http://www.freebsd.org/cgi/query-pr.cgi?pr=163268 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/163268: commit references a PR
Date: Mon, 29 Apr 2013 18:54:44 +0000 (UTC)

 Author: jhb
 Date: Mon Apr 29 18:54:31 2013
 New Revision: 250053
 URL: http://svnweb.freebsd.org/changeset/base/250053
 
 Log:
   Only cleanup CMI-related state on detach if the system supports CMI.
   
   PR:		kern/163268
   MFC after:	1 week
 
 Modified:
   head/sys/dev/acpi_support/acpi_hp.c
 
 Modified: head/sys/dev/acpi_support/acpi_hp.c
 ==============================================================================
 --- head/sys/dev/acpi_support/acpi_hp.c	Mon Apr 29 18:00:53 2013	(r250052)
 +++ head/sys/dev/acpi_support/acpi_hp.c	Mon Apr 29 18:54:31 2013	(r250053)
 @@ -574,28 +574,26 @@ acpi_hp_attach(device_t dev)
  static int
  acpi_hp_detach(device_t dev)
  {
 -	int	ret;
 +	struct acpi_hp_softc *sc;
  	
  	ACPI_FUNCTION_TRACE((char *)(uintptr_t) __func__);
 -	struct acpi_hp_softc *sc = device_get_softc(dev);
 -	if (sc->has_cmi && sc->hpcmi_open_pid != 0) {
 -		ret = EBUSY;
 -	}
 -	else {
 -		if (sc->has_notify) {
 -			ACPI_WMI_REMOVE_EVENT_HANDLER(dev,
 -			    ACPI_HP_WMI_EVENT_GUID);
 -		}
 +	sc = device_get_softc(dev);
 +	if (sc->has_cmi && sc->hpcmi_open_pid != 0)
 +		return (EBUSY);
 +
 +	if (sc->has_notify)
 +		ACPI_WMI_REMOVE_EVENT_HANDLER(dev, ACPI_HP_WMI_EVENT_GUID);
 +
 +	if (sc->has_cmi) {
  		if (sc->hpcmi_bufptr != -1) {
  			sbuf_delete(&sc->hpcmi_sbuf);
  			sc->hpcmi_bufptr = -1;
  		}
  		sc->hpcmi_open_pid = 0;
  		destroy_dev(sc->hpcmi_dev_t);
 -		ret = 0;
  	}
  
 -	return (ret);
 +	return (0);
  }
  
  static int
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 
>Unformatted:
