svn commit: r208316 - stable/8/sys/dev/fxp

[Pyun YongHyeon]

Author: yongari
Date: Wed May 19 21:08:38 2010
New Revision: 208316
URL: http://svn.freebsd.org/changeset/base/208316

Log:
  MFC r208084:
    If controller received bad frames make sure to update newly added
    RFA. Also drop frames that have either CRC error or alignment
    error. Normally bad frames are not received at all. But controllers
    running in promiscuous mode will receive bad frames. 82557 will
    also receive bad frames to receive VLAN oversized frames.
  
    While I'm here mark RNR condition if driver happen to see RNR in
    RFA status and restart RU to receive frames again. Because driver
    checks all received frames in RX loop, RNR condition could be set
    in the middle of RX processing. Just relying on RNR interrupt was
    not enough.
  
    This change fixes "Memory modified after free" issue when fxp(4)
    is running as a member of if_bridge(4).
  
    Tested by:	Larry Baird <lab <> gta dot com>

Modified:
  stable/8/sys/dev/fxp/if_fxp.c
Directory Properties:
  stable/8/sys/   (props changed)
  stable/8/sys/amd64/include/xen/   (props changed)
  stable/8/sys/cddl/contrib/opensolaris/   (props changed)
  stable/8/sys/contrib/dev/acpica/   (props changed)
  stable/8/sys/contrib/pf/   (props changed)
  stable/8/sys/dev/xen/xenpci/   (props changed)
  stable/8/sys/geom/sched/   (props changed)

Modified: stable/8/sys/dev/fxp/if_fxp.c
==============================================================================
--- stable/8/sys/dev/fxp/if_fxp.c	Wed May 19 21:02:02 2010	(r208315)
+++ stable/8/sys/dev/fxp/if_fxp.c	Wed May 19 21:08:38 2010	(r208316)
@@ -1916,6 +1916,8 @@ fxp_intr_body(struct fxp_softc *sc, stru
 		if ((status & FXP_RFA_STATUS_C) == 0)
 			break;
 
+		if ((status & FXP_RFA_STATUS_RNR) != 0)
+			rnr++;
 		/*
 		 * Advance head forward.
 		 */
@@ -1942,9 +1944,12 @@ fxp_intr_body(struct fxp_softc *sc, stru
 				total_len -= 2;
 			}
 			if (total_len < sizeof(struct ether_header) ||
-			    total_len > MCLBYTES - RFA_ALIGNMENT_FUDGE -
-				sc->rfa_size || status & FXP_RFA_STATUS_CRC) {
+			    total_len > (MCLBYTES - RFA_ALIGNMENT_FUDGE -
+			    sc->rfa_size) ||
+			    status & (FXP_RFA_STATUS_CRC |
+			    FXP_RFA_STATUS_ALIGN)) {
 				m_freem(m);
+				fxp_add_rfabuf(sc, rxp);
 				continue;
 			}