⬢ DragonFlyBSD Kernel Audit
DF-5490 / fix.diff
← back to finding ↓ download raw
--- a/sys/bus/iicbus/pcf/pcf.c
+++ b/sys/bus/iicbus/pcf/pcf.c
@@ -121,6 +121,17 @@
 	DEVMETHOD_END
 };
 
+/*
+ * The iicbus child added in pcf_attach() can only attach if the iicbus
+ * driver is registered on the pcf bus (cf. DRIVER_MODULE(smbus, ichsmb,...)
+ * in ichsmb.c:696 and the iicbb bridge list in iicbb.c:441-445).  Without
+ * this registration device_probe_child() finds no driver for the child in
+ * the pcf devclass, the iicbus device never attaches, device_get_softc()
+ * stays NULL, and every iicbus_intr(pcf->iicbus, ...) call in pcfintr()
+ * dereferences it (kernel panic).
+ */
+DRIVER_MODULE(iicbus, pcf, iicbus_driver, iicbus_devclass, NULL, NULL);
+
 static driver_t pcf_driver = {
 	"pcf",
 	pcf_methods,
@@ -396,6 +407,12 @@
 	char data, status, addr;
 	char error = 0;
 
+	/* iicbus child not (yet) attached: nothing to notify.  Covers both
+	 * the setup_intr->device_add_child window in pcf_attach() and the
+	 * child-never-attaches case. */
+	if (pcf->iicbus == NULL || device_get_softc(pcf->iicbus) == NULL)
+		return;
+
 	status = PCF_GET_S1(pcf);
 
 	if (status & PIN) {