kern/77804: [patch] Fix reusing freed memory in if_bfe.c in
6-CURRENT
Tai-hwa Liang
avatar at mmlab.cse.yzu.edu.tw
Sat Mar 12 08:20:05 PST 2005
The following reply was made to PR kern/77804; it has been noted by GNATS.
From: Tai-hwa Liang <avatar at mmlab.cse.yzu.edu.tw>
To: freebsd-gnats-submit at FreeBSD.org
Cc: frank at exit.com
Subject: Re: kern/77804: [patch] Fix reusing freed memory in if_bfe.c in
6-CURRENT
Date: Sun, 13 Mar 2005 00:01:55 +0800 (CST)
Hi Frank,
After discussed with dmlb@ and sam@, we agree that your patch is
needed; however, would you please test following patch again since
this one makes a different assumption on the number of TX/RX descriptors?
--- if_bfe.c.orig Mon Jan 10 03:57:55 2005
+++ if_bfe.c Sat Mar 12 23:52:10 2005
@@ -541,8 +541,6 @@
sc->bfe_tx_ring[i].bfe_mbuf = NULL;
bus_dmamap_unload(sc->bfe_tag,
sc->bfe_tx_ring[i].bfe_map);
- bus_dmamap_destroy(sc->bfe_tag,
- sc->bfe_tx_ring[i].bfe_map);
}
}
bzero(sc->bfe_tx_list, BFE_TX_LIST_SIZE);
@@ -560,15 +558,12 @@
sc->bfe_rx_ring[i].bfe_mbuf = NULL;
bus_dmamap_unload(sc->bfe_tag,
sc->bfe_rx_ring[i].bfe_map);
- bus_dmamap_destroy(sc->bfe_tag,
- sc->bfe_rx_ring[i].bfe_map);
}
}
bzero(sc->bfe_rx_list, BFE_RX_LIST_SIZE);
bus_dmamap_sync(sc->bfe_rx_tag, sc->bfe_rx_map, BUS_DMASYNC_PREREAD);
}
-
static int
bfe_list_rx_init(struct bfe_softc *sc)
{
@@ -975,6 +970,10 @@
for(i = 0; i < BFE_TX_LIST_CNT; i++) {
bus_dmamap_destroy(sc->bfe_tag,
sc->bfe_tx_ring[i].bfe_map);
+ }
+ for(i = 0; i < BFE_RX_LIST_CNT; i++) {
+ bus_dmamap_destroy(sc->bfe_tag,
+ sc->bfe_rx_ring[i].bfe_map);
}
bus_dma_tag_destroy(sc->bfe_tag);
sc->bfe_tag = NULL;
More information about the freebsd-bugs
mailing list