[CHECKER] bugs in FreeBSD

[Matthew Dillon]

     These cam_sim_alloc() calls seem to be fairly critical to the operation
     of DPT and friends, why is it even possible for them to return NULL
     in the first place and what would be the effect of a (properly handled)
     NULL return if it did occur at this point?

					-Matt
					Matthew Dillon 
					<dillon at backplane.com>

:> > 	 * Create the device queue for our SIM.
:> > 	 */
:> > Start --->
:> > 	devq =3D cam_simq_alloc(dpt->max_dccbs);
:> >=20
:...
:> Index: dpt_scsi.c
:> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
:=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
:=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
:> RCS file: /home/ncvs/src/sys/dev/dpt/dpt_scsi.c,v
:> retrieving revision 1.45
:> diff -u -p -r1.45 dpt_scsi.c
:> --- dpt_scsi.c	24 Aug 2003 17:46:04 -0000	1.45
:> +++ dpt_scsi.c	18 Jan 2004 15:39:13 -0000
:> @@ -1553,6 +1553,8 @@ dpt_attach(dpt_softc_t *dpt)
:>  		dpt->sims[i] =3D cam_sim_alloc(dpt_action, dpt_poll, "dpt",
:>  					     dpt, dpt->unit, /*untagged*/2,
:>  					     /*tagged*/dpt->max_dccbs, devq);
:> +		if (dpt->sims[i] =3D=3D NULL)
:> +			break;
:>  		if (xpt_bus_register(dpt->sims[i], i) !=3D CAM_SUCCESS) {
:>  			cam_sim_free(dpt->sims[i], /*free_devq*/i =3D=3D 0);
:>  			break;
:> %%%
:>=20
:Bah, but with this patch that avoids the NULL pointer dereference
:we start leaking devq.  Attached is a more complete patch, and for
:dev/irr/irr.c too.
:
:
:Cheers,
:--=20
:Ruslan Ermilov
:FreeBSD committer
:ru at FreeBSD.org
:
:--yLVHuoLXiP9kZBkt
:Content-Type: text/plain; charset=us-ascii
:Content-Disposition: attachment; filename=p
:
:Index: dpt/dpt_scsi.c
:===================================================================
:RCS file: /home/ncvs/src/sys/dev/dpt/dpt_scsi.c,v
:retrieving revision 1.45
:diff -u -p -r1.45 dpt_scsi.c
:--- dpt/dpt_scsi.c	24 Aug 2003 17:46:04 -0000	1.45
:+++ dpt/dpt_scsi.c	18 Jan 2004 15:51:44 -0000
:@@ -1553,6 +1553,11 @@ dpt_attach(dpt_softc_t *dpt)
: 		dpt->sims[i] = cam_sim_alloc(dpt_action, dpt_poll, "dpt",
: 					     dpt, dpt->unit, /*untagged*/2,
: 					     /*tagged*/dpt->max_dccbs, devq);
:+		if (dpt->sims[i] == NULL) {
:+			if (i == 0)
:+				cam_simq_free(devq);
:+			break;
:+		}
: 		if (xpt_bus_register(dpt->sims[i], i) != CAM_SUCCESS) {
: 			cam_sim_free(dpt->sims[i], /*free_devq*/i == 0);
: 			break;
:Index: iir/iir.c
:===================================================================
:RCS file: /home/ncvs/src/sys/dev/iir/iir.c,v
:retrieving revision 1.9
:diff -u -p -r1.9 iir.c
:--- iir/iir.c	26 Sep 2003 15:36:47 -0000	1.9
:+++ iir/iir.c	18 Jan 2004 15:52:04 -0000
:@@ -510,6 +510,11 @@ iir_attach(struct gdt_softc *gdt)
:         gdt->sims[i] = cam_sim_alloc(iir_action, iir_poll, "iir",
:                                      gdt, gdt->sc_hanum, /*untagged*/2,
:                                      /*tagged*/GDT_MAXCMDS, devq);
:+        if (gdt->sims[i] == NULL) {
:+            if (i == 0)
:+                cam_simq_free(devq);
:+            break;
:+        }
:         if (xpt_bus_register(gdt->sims[i], i) != CAM_SUCCESS) {
:             cam_sim_free(gdt->sims[i], /*free_devq*/i == 0);
:             break;
:
:--yLVHuoLXiP9kZBkt--
:
:--SO98HVl1bnMOfKZd
:Content-Type: application/pgp-signature
:Content-Disposition: inline
:
:-----BEGIN PGP SIGNATURE-----
:Version: GnuPG v1.2.4 (FreeBSD)
:
:iD8DBQFACq9iUkv4P6juNwoRAghWAKCBpqGJmtW1g7vOJS15YgKfg/782QCeImr/
:aZ5eUYh2kvOaSBl5zcFd4mE=
:=j+I+
:-----END PGP SIGNATURE-----