From 288e351b550ea4ca1e35d04d1fcd8efc411e0fcd Mon Sep 17 00:00:00 2001 From: Don Lewis Date: Tue, 13 Jan 2004 22:55:46 +0000 Subject: [PATCH] If a device attach routine fails during boot and calls bus_teardown_intr(), ithread_remove_handler() may fail to remove the interrupt handler if it decides to let the ithread do the removal. The problem is that during boot "cold" is set, which causes msleep() to return immediately. This will cause ithread_remove_handler() to fail to wait for the ithread to do the removal from the handler TAILQ before freeing the handler back to the heap. Bad things will happen when some other user of the TAILQ, such as ithread_add_handler() or the actual ithread attempts to use the freed handler. Fix the problem by forcing ithread_remove_handler() to do the actual removal itself if the "cold" flag is set. Reviewed by: jhb --- sys/kern/kern_intr.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/sys/kern/kern_intr.c b/sys/kern/kern_intr.c index e42cd10385cc..e171da0ef308 100644 --- a/sys/kern/kern_intr.c +++ b/sys/kern/kern_intr.c @@ -331,9 +331,13 @@ ithread_remove_handler(void *cookie) /* * If the interrupt thread is already running, then just mark this * handler as being dead and let the ithread do the actual removal. + * + * During a cold boot while cold is set, msleep() does not sleep, + * so we have to remove the handler here rather than letting the + * thread do it. */ mtx_lock_spin(&sched_lock); - if (!TD_AWAITING_INTR(ithread->it_td)) { + if (!TD_AWAITING_INTR(ithread->it_td) && !cold) { handler->ih_flags |= IH_DEAD; /*