[Midnightbsd-cvs] [MidnightBSD/src] ee40c0: hmt: fix panic on evdev open introduced in fdcf133c61

Thread index · Date index · Mailing lists

From: Lucas Holt <noreply_at_github.com>
Date: Sun, 11 Oct 2026 23:36:34 UTC

  Branch: refs/heads/master\n  Home:   https://github.com/MidnightBSD/src\n  Commit: ee40c08460167db757f725b5e2fc6e711c2bbf91\n      https://github.com/MidnightBSD/src/commit/ee40c08460167db757f725b5e2fc6e711c2bbf91\n  Author: Lucas Holt <luke@foolishgames.com>\n  Date:   2026-10-11 (Sun, 11 Oct 2026)\n\n  Changed paths:\n    M sys/dev/hid/hmt.c\n\n  Log Message:\n  -----------\n  hmt: fix panic on evdev open introduced in fdcf133c61\n\nhmt_ev_open() treated the evdev softc as a struct hmt_softc, but\nhmt_attach() registers the hmt device_t as the evdev softc.  Reading\nsc->dev from a struct device produced a garbage device_t, which\nhidbus_intr_start() then dereferenced to lock a bogus sx inside kernel\ntext:\n\n  panic: vm_fault_lookup: fault on nofault entry, addr: 0xffffffff80c5d000\n  hmt_ev_open -> hidbus_intr_start -> __sx_xlock\n\nThis panicked every boot as soon as moused opened the Framework\ntouchpad's event device.\n\nFetch the device_t first and derive the softc with device_get_softc().\nAlso guard hmt_set_input_mode() against the cached hconf sibling having\nbeen detached, since it is now called from open context rather than\nonly from attach.\n\nCo-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>\n\n\n\nTo unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications\n\nMidnightbsd-cvs\nmidnightbsd-cvs@midnightbsd.org\nTo unsubscribe: midnightbsd-cvs+unsubscribe@midnightbsd.org\nhttps://lists.midnightbsd.org/\n