When the miibus for the AX88x90 or TC5299J cards fails to attach, we

would call ed_release_resources() when we should have called
ed_detach() to properly undo the effects of prior calls to
ed_attach().  This would leave a stray ed interface ifnet alive in the
system, which was, well, bad, since we called if_free() on the
underlying memory...  Fix the ed_detach routine to cope being called
in this context now.

This should never come up because the miibus is always there.  Except
for now when it seems to be failing for reasons unknown...  That's a
different bug that hits at least ed, xl, dc and fxp...

2 files changed, 10 insertions, 8 deletions

diff --git a/sys/dev/ed/if_ed.c b/sys/dev/ed/if_ed.c
index 7851825..a11beda 100644
--- a/sys/dev/ed/if_ed.c
+++ b/sys/dev/ed/if_ed.c
@@ -380,13 +380,15 @@ ed_detach(device_t dev)
 	struct ifnet *ifp = sc->ifp;
 
 	ED_ASSERT_UNLOCKED(sc);
-	ED_LOCK(sc);
-	if (bus_child_present(dev))
-		ed_stop(sc);
-	ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
-	ED_UNLOCK(sc);
-	callout_drain(&sc->tick_ch);
-	ether_ifdetach(ifp);
+	if (ifp) {
+		ED_LOCK(sc);
+		if (bus_child_present(dev))
+			ed_stop(sc);
+		ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
+		ED_UNLOCK(sc);
+		callout_drain(&sc->tick_ch);
+		ether_ifdetach(ifp);
+	}
 	bus_teardown_intr(dev, sc->irq_res, sc->irq_handle);
 	ed_release_resources(dev);
 	ED_LOCK_DESTROY(sc);
diff --git a/sys/dev/ed/if_ed_pccard.c b/sys/dev/ed/if_ed_pccard.c
index 0cd2565..b09ad63 100644
--- a/sys/dev/ed/if_ed_pccard.c
+++ b/sys/dev/ed/if_ed_pccard.c
@@ -572,7 +572,7 @@ ed_pccard_attach(device_t dev)
 		ed_pccard_add_modem(dev);
 	return (0);
 bad:
-	ed_release_resources(dev);
+	ed_detach(dev);
 	return (error);
 }