svn commit: r316541 - head/sys/dev/ixgbe

[Sean Bruno]

Author: sbruno
Date: Wed Apr  5 19:52:49 2017
New Revision: 316541
URL: https://svnweb.freebsd.org/changeset/base/316541

Log:
  Fix a double free in ixgbe_rxeof()
  
  Submitted by:	rstone
  MFC after:	1 week
  Differential Revision:	https://reviews.freebsd.org/D10255

Modified:
  head/sys/dev/ixgbe/ix_txrx.c

Modified: head/sys/dev/ixgbe/ix_txrx.c
==============================================================================
--- head/sys/dev/ixgbe/ix_txrx.c	Wed Apr  5 19:46:24 2017	(r316540)
+++ head/sys/dev/ixgbe/ix_txrx.c	Wed Apr  5 19:52:49 2017	(r316541)
@@ -1431,20 +1431,10 @@ fail:
 
 static void     
 ixgbe_free_receive_ring(struct rx_ring *rxr)
-{ 
-	struct ixgbe_rx_buf       *rxbuf;
+{
 
 	for (int i = 0; i < rxr->num_desc; i++) {
-		rxbuf = &rxr->rx_buffers[i];
-		if (rxbuf->buf != NULL) {
-			bus_dmamap_sync(rxr->ptag, rxbuf->pmap,
-			    BUS_DMASYNC_POSTREAD);
-			bus_dmamap_unload(rxr->ptag, rxbuf->pmap);
-			rxbuf->buf->m_flags |= M_PKTHDR;
-			m_freem(rxbuf->buf);
-			rxbuf->buf = NULL;
-			rxbuf->flags = 0;
-		}
+		ixgbe_rx_discard(rxr, i);
 	}
 }
 
@@ -1596,7 +1586,9 @@ fail:
 	 */
 	for (int i = 0; i < j; ++i) {
 		rxr = &adapter->rx_rings[i];
+		IXGBE_RX_LOCK(rxr);
 		ixgbe_free_receive_ring(rxr);
+		IXGBE_RX_UNLOCK(rxr);
 	}
 
 	return (ENOBUFS);
@@ -1645,14 +1637,7 @@ ixgbe_free_receive_buffers(struct rx_rin
 	if (rxr->rx_buffers != NULL) {
 		for (int i = 0; i < adapter->num_rx_desc; i++) {
 			rxbuf = &rxr->rx_buffers[i];
-			if (rxbuf->buf != NULL) {
-				bus_dmamap_sync(rxr->ptag, rxbuf->pmap,
-				    BUS_DMASYNC_POSTREAD);
-				bus_dmamap_unload(rxr->ptag, rxbuf->pmap);
-				rxbuf->buf->m_flags |= M_PKTHDR;
-				m_freem(rxbuf->buf);
-			}
-			rxbuf->buf = NULL;
+			ixgbe_rx_discard(rxr, i);
 			if (rxbuf->pmap != NULL) {
 				bus_dmamap_destroy(rxr->ptag, rxbuf->pmap);
 				rxbuf->pmap = NULL;
@@ -1722,11 +1707,12 @@ ixgbe_rx_discard(struct rx_ring *rxr, in
 	*/
 
 	if (rbuf->fmp != NULL) {/* Partial chain ? */
-		rbuf->fmp->m_flags |= M_PKTHDR;
+		bus_dmamap_sync(rxr->ptag, rbuf->pmap, BUS_DMASYNC_POSTREAD);
 		m_freem(rbuf->fmp);
 		rbuf->fmp = NULL;
 		rbuf->buf = NULL; /* rbuf->buf is part of fmp's chain */
 	} else if (rbuf->buf) {
+		bus_dmamap_sync(rxr->ptag, rbuf->pmap, BUS_DMASYNC_POSTREAD);
 		m_free(rbuf->buf);
 		rbuf->buf = NULL;
 	}
@@ -1814,6 +1800,8 @@ ixgbe_rxeof(struct ix_queue *que)
 			goto next_desc;
 		}
 
+		bus_dmamap_sync(rxr->ptag, rbuf->pmap, BUS_DMASYNC_POSTREAD);
+
 		/*
 		** On 82599 which supports a hardware
 		** LRO (called HW RSC), packets need