The sk driver developed a bug when the multicast code was changed to

use TAILQ macros. The sk_attach_xmac() routine calls sk_init_xmac()
before doing the transceiver probe, but *before* ether_ifattach()
is called. This causes sk_init_xmac() to call sk_setmulti(), which
tries to do a TAILQ_FOREACH(), which it can't do because ether_ifattach()
hasn't done a TAILQ_INIT() yet. This causes a NULL pointer dereference
and panic in sk_setmulti() at driver load/initialization time.

Fixed by calling ether_ifattach() before the MII probe.

The code in RELENG_4 still uses the old way of enumerating the
multicast list and doesn't have this problem. Yet.

1 files changed, 7 insertions, 6 deletions

diff --git a/sys/pci/if_sk.c b/sys/pci/if_sk.c
index 4b5e7f6..83d5720 100644
--- a/sys/pci/if_sk.c
+++ b/sys/pci/if_sk.c
@@ -1148,6 +1148,12 @@ static int sk_attach_xmac(dev)
 	ifp->if_snd.ifq_maxlen = SK_TX_RING_CNT - 1;
 
 	/*
+	 * Call MI attach routine.
+	 */
+	ether_ifattach(ifp, ETHER_BPF_SUPPORTED);
+	callout_handle_init(&sc_if->sk_tick_ch);
+
+	/*
 	 * Do miibus setup.
 	 */
 	sk_init_xmac(sc_if);
@@ -1156,16 +1162,11 @@ static int sk_attach_xmac(dev)
 		printf("skc%d: no PHY found!\n", sc_if->sk_unit);
 		contigfree(sc_if->sk_rdata,
 		    sizeof(struct sk_ring_data), M_DEVBUF);
+		ether_ifdetach(ifp, ETHER_BPF_SUPPORTED);
 		SK_UNLOCK(sc);
 		return(ENXIO);
 	}
 
-	/*
-	 * Call MI attach routine.
-	 */
-	ether_ifattach(ifp, ETHER_BPF_SUPPORTED);
-	callout_handle_init(&sc_if->sk_tick_ch);
-
 	SK_UNLOCK(sc);
 
 	return(0);