Date: Sun, 20 Feb 2005 19:36:21 +0100 From: Max Laier <max@love2party.net> To: freebsd-hackers@freebsd.org Subject: Small bug fix from DragonFly / review requested Message-ID: <200502201936.31366.max@love2party.net>
next in thread | raw e-mail | index | archive | help
--nextPart1519726.JNeFxxl3j4 Content-Type: multipart/mixed; boundary="Boundary-01=_miNGCEO5vkILfbd" Content-Transfer-Encoding: 7bit Content-Disposition: inline --Boundary-01=_miNGCEO5vkILfbd Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline Joerg Sonnenberger has discovered a problem in the snc(4) driver that might= =20 result in packets showing up on bpf multiple times. See the changelog for= =20 sys/dev/netif/snc/dp83932.c in their source tree[1]. Attached is a fix for HEAD. I am almost sure that it is right, but I'd=20 welcome a review as there might be a chance that sonicput() and the TX=20 interrupt free the mbuf before it gets to bpf. From my reading it seems th= at=20 the mbuf is "safe" until sc->mtd_free is altered (see comment). Thanks for your input. [1] http://www.dragonflybsd.org/cvsweb/src/sys/dev/netif/snc/dp83932.c =2D-=20 /"\ Best regards, | mlaier@freebsd.org \ / Max Laier | ICQ #67774661 X http://pf4freebsd.love2party.net/ | mlaier@EFnet / \ ASCII Ribbon Campaign | Against HTML Mail and News --Boundary-01=_miNGCEO5vkILfbd Content-Type: text/x-diff; charset="us-ascii"; name="dp83932.c.diff" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="dp83932.c.diff" Index: dp83932.c =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D RCS file: /usr/store/mlaier/fcvs/src/sys/dev/snc/dp83932.c,v retrieving revision 1.16 diff -u -r1.16 dp83932.c =2D-- dp83932.c 6 Jan 2005 01:43:15 -0000 1.16 +++ dp83932.c 20 Feb 2005 18:23:22 -0000 @@ -346,12 +346,6 @@ M_ASSERTPKTHDR(m); =20 /* =2D * If bpf is listening on this interface, let it =2D * see the packet before we commit it to the wire. =2D */ =2D BPF_MTAP(ifp, m); =2D =2D /* * If there is nothing in the o/p queue, and there is room in * the Tx ring, then send the packet directly. Otherwise append * it to the o/p queue. @@ -361,6 +355,14 @@ return; } =20 + /* + * If bpf is listening on this interface, let it see the packet + * before we commit it to the wire, but only if we are really + * committed to send it. The mbuf is "safe" until we modify + * sc->mtd_free (below). + */ + BPF_MTAP(ifp, m); + sc->mtd_prev =3D sc->mtd_free; sc->mtd_free =3D mtd_next; =20 --Boundary-01=_miNGCEO5vkILfbd-- --nextPart1519726.JNeFxxl3j4 Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (FreeBSD) iD8DBQBCGNivXyyEoT62BG0RArtjAJ91DeXlwRUgl5bQZYaQMwadwLOSnwCfd/sx twUOdVJGrb4OUXFFJu4t4gI= =mDHd -----END PGP SIGNATURE----- --nextPart1519726.JNeFxxl3j4--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200502201936.31366.max>