Date: Wed, 2 May 2001 21:09:39 -0500 (CDT) From: Jonathan Lemon <jlemon@flugsvamp.com> To: tlambert@primenet.com, current@freebsd.org Subject: Re: panic in fxp driver Message-ID: <200105030209.f4329dR74591@prism.flugsvamp.com> In-Reply-To: <local.mail.freebsd-current/200105030158.SAA29983@usr09.primenet.com>
index | next in thread | previous in thread | raw e-mail
In article <local.mail.freebsd-current/200105030158.SAA29983@usr09.primenet.com> you write:
>The fxp driver is broken in a lot of places.
>
>For example, in fxp_intr():
>
> for (txp = sc->cbl_first; sc->tx_queued &&
> (txp->cb_status & FXP_CB_STATUS_C) != 0;
> txp = txp->next) {
> if (txp->mb_head != NULL) {
> m_freem(txp->mb_head);
> txp->mb_head = NULL;
> }
> sc->tx_queued--;
> }
>
>...notice the "for" loop doesn't check to see if "txp = txp->next"
>ends up being NULL? You can get this, if you put your system
>under extreme load.
I would be quite interested in knowing just how you manage
to accomplish that, given that all the transmit control buffers
are arranged in a circular linked list:
fxp_init(void *xsc)
{
...
for (i = 0; i < FXP_NTXCB; i++) {
...
txp[i].next = &txp[(i + 1) & FXP_TXCB_MASK];
}
I would suggest actually examining the rest of the code to see
how it works before making erroneous proclamations based on the
myopic examination of a single statement.
--
Jonathan
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-current" in the body of the message
help
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200105030209.f4329dR74591>