kern/77804: [patch] Fix reusing freed memory in if_bfe.c in 6-CURRENT

[Tai-hwa Liang]

The following reply was made to PR kern/77804; it has been noted by GNATS.

From: Tai-hwa Liang <avatar at mmlab.cse.yzu.edu.tw>
To: freebsd-gnats-submit at FreeBSD.org
Cc: frank at exit.com
Subject: Re: kern/77804: [patch] Fix reusing freed memory in if_bfe.c in
 6-CURRENT
Date: Sun, 13 Mar 2005 00:01:55 +0800 (CST)

 Hi Frank,
 
    After discussed with dmlb@ and sam@, we agree that your patch is
 needed; however, would you please test following patch again since
 this one makes a different assumption on the number of TX/RX descriptors?
 
 --- if_bfe.c.orig	Mon Jan 10 03:57:55 2005
 +++ if_bfe.c	Sat Mar 12 23:52:10 2005
 @@ -541,8 +541,6 @@
   			sc->bfe_tx_ring[i].bfe_mbuf = NULL;
   			bus_dmamap_unload(sc->bfe_tag,
   					sc->bfe_tx_ring[i].bfe_map);
 -			bus_dmamap_destroy(sc->bfe_tag,
 -					sc->bfe_tx_ring[i].bfe_map);
   		}
   	}
   	bzero(sc->bfe_tx_list, BFE_TX_LIST_SIZE);
 @@ -560,15 +558,12 @@
   			sc->bfe_rx_ring[i].bfe_mbuf = NULL;
   			bus_dmamap_unload(sc->bfe_tag,
   					sc->bfe_rx_ring[i].bfe_map);
 -			bus_dmamap_destroy(sc->bfe_tag,
 -					sc->bfe_rx_ring[i].bfe_map);
   		}
   	}
   	bzero(sc->bfe_rx_list, BFE_RX_LIST_SIZE);
   	bus_dmamap_sync(sc->bfe_rx_tag, sc->bfe_rx_map, BUS_DMASYNC_PREREAD);
   }
 
 -
   static int
   bfe_list_rx_init(struct bfe_softc *sc)
   {
 @@ -975,6 +970,10 @@
   		for(i = 0; i < BFE_TX_LIST_CNT; i++) {
   			bus_dmamap_destroy(sc->bfe_tag,
   			    sc->bfe_tx_ring[i].bfe_map);
 +		}
 +		for(i = 0; i < BFE_RX_LIST_CNT; i++) {
 +			bus_dmamap_destroy(sc->bfe_tag,
 +			    sc->bfe_rx_ring[i].bfe_map);
   		}
   		bus_dma_tag_destroy(sc->bfe_tag);
   		sc->bfe_tag = NULL;