When the miibus for the AX88x90 or TC5299J cards fails to attach, we

would call ed_release_resources() when we should have called
ed_detach() to properly undo the effects of prior calls to
ed_attach().  This would leave a stray ed interface ifnet alive in the
system, which was, well, bad, since we called if_free() on the
underlying memory...  Fix the ed_detach routine to cope being called
in this context now.

This should never come up because the miibus is always there.  Except
for now when it seems to be failing for reasons unknown...  That's a
different bug that hits at least ed, xl, dc and fxp...

2 files changed, 10 insertions, 8 deletions

diff --git a/sys/dev/ed/if_ed.c b/sys/dev/ed/if_ed.c
index 785182539cce..a11beda48f07 100644
--- a/sys/dev/ed/if_ed.c
+++ b/sys/dev/ed/if_ed.c
@@ -380,13 +380,15 @@ ed_detach(device_t dev)
 	struct ifnet *ifp = sc->ifp;
 
 	ED_ASSERT_UNLOCKED(sc);
-	ED_LOCK(sc);
-	if (bus_child_present(dev))
-		ed_stop(sc);
-	ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
-	ED_UNLOCK(sc);
-	callout_drain(&sc->tick_ch);
-	ether_ifdetach(ifp);
+	if (ifp) {
+		ED_LOCK(sc);
+		if (bus_child_present(dev))
+			ed_stop(sc);
+		ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
+		ED_UNLOCK(sc);
+		callout_drain(&sc->tick_ch);
+		ether_ifdetach(ifp);
+	}
 	bus_teardown_intr(dev, sc->irq_res, sc->irq_handle);
 	ed_release_resources(dev);
 	ED_LOCK_DESTROY(sc);
diff --git a/sys/dev/ed/if_ed_pccard.c b/sys/dev/ed/if_ed_pccard.c
index 0cd2565d3a72..b09ad63e4564 100644
--- a/sys/dev/ed/if_ed_pccard.c
+++ b/sys/dev/ed/if_ed_pccard.c
@@ -572,7 +572,7 @@ ed_pccard_attach(device_t dev)
 		ed_pccard_add_modem(dev);
 	return (0);
 bad:
-	ed_release_resources(dev);
+	ed_detach(dev);
 	return (error);
 }