svn commit: r320629 - head/sys/dev/ena

[Zbigniew Bodek]

Author: zbb
Date: Tue Jul  4 00:04:31 2017
New Revision: 320629
URL: https://svnweb.freebsd.org/changeset/base/320629

Log:
  Call drbr_advance() before leaving TX routine
  
  If drbr_advance() is not called before doing cleanup and packet is
  already enqueued for sending (tx_info is holding pointer to mbuf), then
  mbuf is cleaned both in drbr_flush() and in cleanup routine, when all
  mbufs hold by tx_buffer_info are being released.
  
  This causes panic, because mbuf is released twice.
  
  Submitted by:   Michal Krawczyk <mk at semihalf.com>
  Obtained from:  Semihalf
  Sponsored by:   Amazon.com Inc.

Modified:
  head/sys/dev/ena/ena.c

Modified: head/sys/dev/ena/ena.c
==============================================================================
--- head/sys/dev/ena/ena.c	Tue Jul  4 00:02:28 2017	(r320628)
+++ head/sys/dev/ena/ena.c	Tue Jul  4 00:04:31 2017	(r320629)
@@ -2805,10 +2805,11 @@ ena_start_xmit(struct ena_ring *tx_ring)
 			break;
 		}
 
+		drbr_advance(adapter->ifp, tx_ring->br);
+
 		if ((adapter->ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
 			return;
 
-		drbr_advance(adapter->ifp, tx_ring->br);
 		acum_pkts++;
 
 		BPF_MTAP(adapter->ifp, mbuf);