On Sat, 25 Jul 2026, Ryan Libby wrote:
Drive-by comment, I don't know this code.
It seems to suggest pdev->bus in lkpi_pci_dev_release points to a
freed object. Back in linux_pci_attach_device (frame #26), in the
probe failure path that does goto out_probe, we free(pdev->bus,
M_DEVBUF), and then call put_device(&pdev->dev) (frame #25), and then
in lkpi_pci_dev_release (frame #21) we try to use the freed pdev->bus.
You could try assigning pdev->bus to a distinct junk value after the
free in linux_pci_attach_device to confirm this.
Yes, my comment I left before writing the reviews essentially gathers
some of these problems. I think focusing on
https://reviews.freebsd.org/D57430
would be good. I'll have to go back to it as well and fold it in.
/bz
--
Bjoern A. Zeeb r15:7
