kern/127644: NDIS panic

[Antoine Pelisse]

>Number:         127644
>Category:       kern
>Synopsis:       NDIS panic
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Sep 26 09:30:02 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     Antoine Pelisse
>Release:        8.0-CURRENT
>Organization:
>Environment:
FreeBSD eeepc 8.0-CURRENT FreeBSD 8.0-CURRENT #12: Wed Sep 24 09:41:05 CEST 2008
i386
>Description:
NDIS is crashing while using a rt2860 wireless card.

See Fix to the problem below
>How-To-Repeat:
Error is 100% reproducible. Load the module generated by ndisgen rt2860.ko
after few packets are sent/received, kernel panics.
>Fix:
sys/dev/if_ndis/if_ndisvar.h:
#define NDIS_TXPKTS 64
#define NDIS_INC(x)             \
        (x)->ndis_txidx = ((x)->ndis_txidx + 1) % NDIS_TXPKTS 

sc->ndis_txidx should cycle between 0 and sc->ndis_maxpkts as sc->ndis_tmaps is allocated with sc->ndis_maxpkts elements.

By the way, sc->ndis_txarray and sc->ndis_txpool are allocated with NDIS_TXPKTS
 while it only uses sc->ndis_maxpkts elements.

Patch attached with submission follows:

diff -u if_ndis.old/if_ndis.c if_ndis/if_ndis.c
--- if_ndis.old/if_ndis.c	2008-09-24 09:38:28.000000000 +0200
+++ if_ndis/if_ndis.c	2008-09-24 09:39:50.000000000 +0200
@@ -641,12 +641,12 @@
 		sc->ndis_maxpkts = 10;
 
 	sc->ndis_txarray = malloc(sizeof(ndis_packet *) *
-	    NDIS_TXPKTS, M_DEVBUF, M_NOWAIT|M_ZERO);
+	    sc->ndis_maxpkts, M_DEVBUF, M_NOWAIT|M_ZERO);
 
 	/* Allocate a pool of ndis_packets for TX encapsulation. */
 
 	NdisAllocatePacketPool(&i, &sc->ndis_txpool,
-	   NDIS_TXPKTS, PROTOCOL_RESERVED_SIZE_IN_PACKET);
+	    sc->ndis_maxpkts, PROTOCOL_RESERVED_SIZE_IN_PACKET);
 
 	if (i != NDIS_STATUS_SUCCESS) {
 		sc->ndis_txpool = NULL;
diff -u if_ndis.old/if_ndisvar.h if_ndis/if_ndisvar.h
--- if_ndis.old/if_ndisvar.h	2008-09-24 09:38:28.000000000 +0200
+++ if_ndis/if_ndisvar.h	2008-09-24 09:38:56.000000000 +0200
@@ -87,7 +87,7 @@
 
 #define NDIS_TXPKTS 64
 #define NDIS_INC(x)		\
-	(x)->ndis_txidx = ((x)->ndis_txidx + 1) % NDIS_TXPKTS
+	(x)->ndis_txidx = ((x)->ndis_txidx + 1) % (x)->ndis_maxpkts
 
 
 #define NDIS_EVENTS 4


>Release-Note:
>Audit-Trail:
>Unformatted: