diff --git a/sys/bus/firewire/fwohci_pci.c b/sys/bus/firewire/fwohci_pci.c --- a/sys/bus/firewire/fwohci_pci.c +++ b/sys/bus/firewire/fwohci_pci.c @@ -443,6 +443,15 @@ if (err) { device_printf(parent, "probe_and_attach failed with err=%d\n", err); + /* + * Clear fc.bdev so fwohci_pci_detach() does not call + * device_delete_child(self, sc->fc.bdev) on the child we + * are about to delete ourselves. Otherwise the detach + * frees the child (kobj_delete in subr_bus.c:1306) and the + * explicit device_delete_child below dereferences freed + * memory and double-frees it. + */ + sc->fc.bdev = NULL; fwohci_pci_detach(parent); device_delete_child(parent, child); return NULL;