From 4e44ebfd93eaa0026cce623f4752ca50f8ef739c Mon Sep 17 00:00:00 2001 From: imp Date: Sat, 23 Aug 2008 15:29:28 +0000 Subject: [PATCH] It turns out that my analysis of the error handling here was wrong. When there's an error, we don't want to free the children, since it will be stack garbage. While we did fail to dereference it by setting devs to 0, we didn't fail to call free. We never failed to fail, it was the easiest thing to do. --- sys/dev/mii/mlphy.c | 14 +++++++------- sys/dev/mii/tlphy.c | 5 ++--- 2 files changed, 9 insertions(+), 10 deletions(-) diff --git a/sys/dev/mii/mlphy.c b/sys/dev/mii/mlphy.c index 9eba9da899e0..d44d36f2cf17 100644 --- a/sys/dev/mii/mlphy.c +++ b/sys/dev/mii/mlphy.c @@ -194,15 +194,15 @@ mlphy_service(xsc, mii, cmd) * See if there's another PHY on this bus with us. * If so, we may need it for 10Mbps modes. */ - devs = 0; - device_get_children(msc->ml_mii.mii_dev, &devlist, &devs); - for (i = 0; i < devs; i++) { - if (strcmp(device_get_name(devlist[i]), "mlphy")) { - other = device_get_softc(devlist[i]); - break; + if (device_get_children(msc->ml_mii.mii_dev, &devlist, &devs) == 0) { + for (i = 0; i < devs; i++) { + if (strcmp(device_get_name(devlist[i]), "mlphy")) { + other = device_get_softc(devlist[i]); + break; + } } + free(devlist, M_TEMP); } - free(devlist, M_TEMP); switch (cmd) { case MII_POLLSTAT: diff --git a/sys/dev/mii/tlphy.c b/sys/dev/mii/tlphy.c index 6a603c299562..9872cb30519c 100644 --- a/sys/dev/mii/tlphy.c +++ b/sys/dev/mii/tlphy.c @@ -162,9 +162,8 @@ tlphy_attach(device_t dev) sc->sc_mii.mii_pdata = mii; capmask = 0xFFFFFFFF; - if (mii->mii_instance) { - devs = 0; - device_get_children(sc->sc_mii.mii_dev, &devlist, &devs); + if (mii->mii_instance && + device_get_children(sc->sc_mii.mii_dev, &devlist, &devs) == 0) { for (i = 0; i < devs; i++) { if (strcmp(device_get_name(devlist[i]), "tlphy")) { other = device_get_softc(devlist[i]);