svn commit: r199930 - stable/8/sys/dev/re

[Pyun YongHyeon]

Author: yongari
Date: Sun Nov 29 19:49:21 2009
New Revision: 199930
URL: http://svn.freebsd.org/changeset/base/199930

Log:
  MFC 198814.
    Add a check to know whether driver is still running after
    reacquiring driver lock in Rx handler. re(4) drops a driver lock
    before passing received frame to upper stack and reacquire the
    lock. During the time window ioctl calls could be executed and if
    the ioctl was interface down request, driver will stop the
    controller and free allocated mbufs. After that when driver comes
    back to Rx handler again it does not know what was happend so it
    could access free mbufs which in turn cause panic.
  
    Reported by:	Norbert Papke < npapk <> acm dot org >
    Tested by:	Norbert Papke < npapk <> acm dot org >

Modified:
  stable/8/sys/dev/re/if_re.c
Directory Properties:
  stable/8/sys/   (props changed)
  stable/8/sys/amd64/include/xen/   (props changed)
  stable/8/sys/cddl/contrib/opensolaris/   (props changed)
  stable/8/sys/contrib/dev/acpica/   (props changed)
  stable/8/sys/contrib/pf/   (props changed)
  stable/8/sys/dev/xen/xenpci/   (props changed)

Modified: stable/8/sys/dev/re/if_re.c
==============================================================================
--- stable/8/sys/dev/re/if_re.c	Sun Nov 29 19:47:31 2009	(r199929)
+++ stable/8/sys/dev/re/if_re.c	Sun Nov 29 19:49:21 2009	(r199930)
@@ -1817,6 +1817,8 @@ re_rxeof(struct rl_softc *sc, int *rx_np
 
 	for (i = sc->rl_ldata.rl_rx_prodidx; maxpkt > 0;
 	    i = RL_RX_DESC_NXT(sc, i)) {
+		if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
+			break;
 		cur_rx = &sc->rl_ldata.rl_rx_list[i];
 		rxstat = le32toh(cur_rx->rl_cmdstat);
 		if ((rxstat & RL_RDESC_STAT_OWN) != 0)