From 4e70215e6bf590140205774753c8b0a1f1fe9a36 Mon Sep 17 00:00:00 2001 From: imp Date: Mon, 19 Sep 2005 03:10:21 +0000 Subject: Make sure that we call if_free(ifp) after bus_teardown_intr. Since we could get an interrupt after we free the ifp, and the interrupt handler depended on the ifp being still alive, this could, in theory, cause a crash. Eliminate this possibility by moving the if_free to after the bus_teardown_intr() call. --- sys/dev/cp/if_cp.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'sys/dev/cp/if_cp.c') diff --git a/sys/dev/cp/if_cp.c b/sys/dev/cp/if_cp.c index ab24f6f..f6ecd74 100644 --- a/sys/dev/cp/if_cp.c +++ b/sys/dev/cp/if_cp.c @@ -1438,6 +1438,9 @@ static int cp_detach (device_t dev) cp_reset (b, 0 ,0); callout_stop (&led_timo[b->num]); + /* Disable the interrupt request. */ + bus_teardown_intr (dev, bd->cp_irq, bd->cp_intrhand); + for (c=b->chan; cchan+NCHAN; ++c) { drv_t *d = (drv_t*) c->sys; @@ -1470,8 +1473,6 @@ static int cp_detach (device_t dev) b->sys = NULL; CP_UNLOCK (bd); - /* Disable the interrupt request. */ - bus_teardown_intr (dev, bd->cp_irq, bd->cp_intrhand); bus_deactivate_resource (dev, SYS_RES_IRQ, 0, bd->cp_irq); bus_release_resource (dev, SYS_RES_IRQ, 0, bd->cp_irq); bus_release_resource (dev, SYS_RES_MEMORY, PCIR_BAR(0), bd->cp_res); -- cgit v1.1