From owner-svn-src-head@FreeBSD.ORG Mon Jan 6 03:48:33 2014 Return-Path: Delivered-To: svn-src-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 4CCC137B; Mon, 6 Jan 2014 03:48:33 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 1BDDF10AB; Mon, 6 Jan 2014 03:48:33 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id s063mWCB031853; Mon, 6 Jan 2014 03:48:32 GMT (envelope-from adrian@svn.freebsd.org) Received: (from adrian@localhost) by svn.freebsd.org (8.14.7/8.14.7/Submit) id s063mW8C031852; Mon, 6 Jan 2014 03:48:32 GMT (envelope-from adrian@svn.freebsd.org) Message-Id: <201401060348.s063mW8C031852@svn.freebsd.org> From: Adrian Chadd Date: Mon, 6 Jan 2014 03:48:32 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r260363 - head/sys/dev/ath X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jan 2014 03:48:33 -0000 Author: adrian Date: Mon Jan 6 03:48:32 2014 New Revision: 260363 URL: http://svnweb.freebsd.org/changeset/base/260363 Log: Correctly remove entries from the relevant receive ath_buf list before freeing them. The current code would walk the list and call the buffer free, which didn't remove it from any lists before pushing it back on the free list. Tested: AR9485, STA mode Noticed by: dillon@apollo.dragonflybsd.org Modified: head/sys/dev/ath/if_ath_rx_edma.c Modified: head/sys/dev/ath/if_ath_rx_edma.c ============================================================================== --- head/sys/dev/ath/if_ath_rx_edma.c Mon Jan 6 01:51:08 2014 (r260362) +++ head/sys/dev/ath/if_ath_rx_edma.c Mon Jan 6 03:48:32 2014 (r260363) @@ -450,18 +450,20 @@ ath_edma_recv_proc_queue(struct ath_soft static void ath_edma_flush_deferred_queue(struct ath_softc *sc) { - struct ath_buf *bf, *next; + struct ath_buf *bf; ATH_RX_LOCK_ASSERT(sc); /* Free in one set, inside the lock */ - TAILQ_FOREACH_SAFE(bf, - &sc->sc_rx_rxlist[HAL_RX_QUEUE_LP], bf_list, next) { + while (! TAILQ_EMPTY(&sc->sc_rx_rxlist[HAL_RX_QUEUE_LP])) { + bf = TAILQ_FIRST(&sc->sc_rx_rxlist[HAL_RX_QUEUE_LP]); + TAILQ_REMOVE(&sc->sc_rx_rxlist[HAL_RX_QUEUE_LP], bf, bf_list); /* Free the buffer/mbuf */ ath_edma_rxbuf_free(sc, bf); } - TAILQ_FOREACH_SAFE(bf, - &sc->sc_rx_rxlist[HAL_RX_QUEUE_HP], bf_list, next) { + while (! TAILQ_EMPTY(&sc->sc_rx_rxlist[HAL_RX_QUEUE_HP])) { + bf = TAILQ_FIRST(&sc->sc_rx_rxlist[HAL_RX_QUEUE_HP]); + TAILQ_REMOVE(&sc->sc_rx_rxlist[HAL_RX_QUEUE_HP], bf, bf_list); /* Free the buffer/mbuf */ ath_edma_rxbuf_free(sc, bf); } @@ -495,6 +497,10 @@ ath_edma_recv_proc_deferred_queue(struct ATH_RX_UNLOCK(sc); /* Handle the completed descriptors */ + /* + * XXX is this SAFE call needed? The ath_buf entries + * aren't modified by ath_rx_pkt, right? + */ TAILQ_FOREACH_SAFE(bf, &rxlist, bf_list, next) { /* * Skip the RX descriptor status - start at the data offset @@ -520,7 +526,9 @@ ath_edma_recv_proc_deferred_queue(struct /* Free in one set, inside the lock */ ATH_RX_LOCK(sc); - TAILQ_FOREACH_SAFE(bf, &rxlist, bf_list, next) { + while (! TAILQ_EMPTY(&rxlist)) { + bf = TAILQ_FIRST(&rxlist); + TAILQ_REMOVE(&rxlist, bf, bf_list); /* Free the buffer/mbuf */ ath_edma_rxbuf_free(sc, bf); }