PERFORCE change 137039 for review

Kip Macy kmacy at FreeBSD.org
Fri Mar 7 00:28:37 UTC 2008


http://perforce.freebsd.org/chv.cgi?CH=137039

Change 137039 by kmacy at pandemonium:kmacy:iwarp on 2008/03/07 00:28:21

	make changes to help identify use after free

Affected files ...

.. //depot/projects/iwarp/sys/dev/cxgb/ulp/tom/cxgb_t3_ddp.h#8 edit
.. //depot/projects/iwarp/sys/dev/cxgb/ulp/tom/cxgb_toepcb.h#5 edit
.. //depot/projects/iwarp/sys/dev/cxgb/ulp/tom/cxgb_tom.c#14 edit

Differences ...

==== //depot/projects/iwarp/sys/dev/cxgb/ulp/tom/cxgb_t3_ddp.h#8 (text+ko) ====

@@ -109,13 +109,13 @@
 	unsigned short kbuf_noinval;
 	unsigned short kbuf_idx;        /* which HW buffer is used for kbuf */
 	struct ddp_gather_list *ubuf;
+	int user_ddp_pending;
 	unsigned int ubuf_nppods;       /* # of page pods for buffer 1 */
 	unsigned int ubuf_tag;
 	unsigned int ubuf_ddp_ready;
+	int cancel_ubuf;
 	int get_tcb_count;
 	unsigned int kbuf_posted;
-	int cancel_ubuf;
-	int user_ddp_pending;
 	unsigned int kbuf_nppods[NUM_DDP_KBUF];
 	unsigned int kbuf_tag[NUM_DDP_KBUF];
 	struct ddp_gather_list *kbuf[NUM_DDP_KBUF]; /* kernel buffer for DDP prefetch */

==== //depot/projects/iwarp/sys/dev/cxgb/ulp/tom/cxgb_toepcb.h#5 (text+ko) ====

@@ -36,8 +36,8 @@
 struct toepcb {
 	struct toedev 		*tp_toedev;
 	struct l2t_entry 	*tp_l2t;
-	pr_ctloutput_t 		*tp_ctloutput;
 	unsigned int 		tp_tid;
+
 	int 			tp_wr_max;
 	int 			tp_wr_avail;
 	int 			tp_wr_unacked;
@@ -66,7 +66,7 @@
 	bus_dma_tag_t		tp_tx_dmat;
 	bus_dma_tag_t		tp_rx_dmat;
 	bus_dmamap_t		tp_dmamap;
-
+	
 	LIST_ENTRY(toepcb) 	synq_entry;
 	struct mbuf_head 	wr_list;
 	struct mbuf_head 	out_of_order_queue;

==== //depot/projects/iwarp/sys/dev/cxgb/ulp/tom/cxgb_tom.c#14 (text+ko) ====

@@ -162,7 +162,7 @@
 {
 	struct toepcb *toep;
 	
-	toep = malloc(sizeof(struct toepcb), M_DEVBUF, M_NOWAIT|M_ZERO);
+	toep = malloc(sizeof(struct toepcb), M_CXGB, M_NOWAIT|M_ZERO);
 	
 	if (toep == NULL)
 		return (NULL);
@@ -188,7 +188,7 @@
 toepcb_release(struct toepcb *toep)
 {
 	if (toep->tp_refcount == 1) {
-		free(toep, M_DEVBUF);
+		free(toep, M_CXGB);
 		return;
 	}
 	atomic_add_acq_int(&toep->tp_refcount, -1);
@@ -1057,8 +1057,8 @@
 {
 	struct t3c_data *td = T3C_DATA (tdev);
 	struct toe_tid_entry *p = &td->tid_maps.tid_tab[tid];
-
-	printf("queuing tid release\n");
+	
+	CTR0(KTR_TOM, "queuing tid release\n");
 	
 	mtx_lock(&td->tid_release_lock);
 	p->ctx = td->tid_release_list;


More information about the p4-projects mailing list