Add a note about a bug in how sio manages its softc. This was

discovered by Dorr H. Clark.  I'm not at all sure how to fix it, but
wanted to document it at the very least...

1 files changed, 15 insertions, 0 deletions

diff --git a/sys/dev/sio/sio.c b/sys/dev/sio/sio.c
index a4cca4d..2eb2ad1 100644
--- a/sys/dev/sio/sio.c
+++ b/sys/dev/sio/sio.c
@@ -696,6 +696,14 @@ sioprobe(dev, xrid, rclk, noprobe)
 		bus_release_resource(dev, SYS_RES_IOPORT, rid, port);
 		if (iobase == siocniobase)
 			result = 0;
+		/*
+		 * XXX: Since we don't return 0, we shouldn't be relying on
+		 * the softc that we set to persist to the call to attach
+		 * since other probe routines may be called, and the malloc
+		 * here causes subr_bus to not allocate anything for the
+		 * other probes.  Instead, this softc is preserved and other
+		 * probe routines can corrupt it.
+		 */
 		if (result != 0) {
 			device_set_softc(dev, NULL);
 			free(com, M_DEVBUF);
@@ -773,6 +781,13 @@ sioprobe(dev, xrid, rclk, noprobe)
 	bus_release_resource(dev, SYS_RES_IOPORT, rid, port);
 	if (iobase == siocniobase)
 		result = 0;
+	/*
+	 * XXX: Since we don't return 0, we shouldn't be relying on the softc
+	 * that we set to persist to the call to attach since other probe
+	 * routines may be called, and the malloc here causes subr_bus to not
+	 * allocate anything for the other probes.  Instead, this softc is
+	 * preserved and other probe routines can corrupt it.
+	 */
 	if (result != 0) {
 		device_set_softc(dev, NULL);
 		free(com, M_DEVBUF);