i386/72795: LOR between NDIS lock and route lock.

[Frank Mayhar]

>Number:         72795
>Category:       i386
>Synopsis:       LOR between NDIS lock and route lock.
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-i386
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Oct 17 19:40:28 GMT 2004
>Closed-Date:
>Last-Modified:
>Originator:     Frank Mayhar
>Release:        FreeBSD 5.3-BETA7 i386
>Organization:
Exit Consulting
>Environment:
System: FreeBSD lap 5.3-STABLE FreeBSD 5.3-STABLE #3: Sun Oct 17 12:02:39 PDT 2004     frank at lap:/home/obj/usr/src/sys/AUTON  i386


	
	This is the latest and greatest 5.3 on my Inspiron 5160.
>Description:
	I'm using ndis to employ a Dell 1450 dual-band wireless card.  Using
	the single-band card that came with the laptop this didn't happen,
	but when I began using the new one I started seeing near-constant
	panics.

>How-To-Repeat:
	Load the system lightly, then do network stuff (a flood ping works
	perfectly).

>Fix:
	It turns out that the first thing I checked appears to be the problem.
	ndis_start() has a single path that fails to drop the NDIS lock before
	it returns.  I fixed that and the system has survived a flood ping for
	several minutes now.  The diff is appended.

	NOTE:  This should almost certainly get into 5.3-stable.  It's a nasty.


Index: if_ndis.c
===================================================================
RCS file: /cvs/repos/src/sys/dev/if_ndis/if_ndis.c,v
retrieving revision 1.69.2.1
diff -u -r1.69.2.1 if_ndis.c
--- if_ndis.c	9 Oct 2004 15:20:18 -0000	1.69.2.1
+++ if_ndis.c	17 Oct 2004 18:58:52 -0000
@@ -1291,8 +1291,10 @@
 			break;
 	}
 
-	if (pcnt == 0)
+	if (pcnt == 0) {
+		NDIS_UNLOCK(sc);
 		return;
+	}
 
 	if (sc->ndis_txpending == 0)
 		ifp->if_flags |= IFF_OACTIVE;
>Release-Note:
>Audit-Trail:
>Unformatted: