From owner-cvs-all  Tue Aug 14 14:57: 3 2001
Delivered-To: cvs-all@freebsd.org
Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21])
	by hub.freebsd.org (Postfix) with ESMTP
	id 0E52437B405; Tue, 14 Aug 2001 14:56:54 -0700 (PDT)
	(envelope-from wpaul@FreeBSD.org)
Received: (from wpaul@localhost)
	by freefall.freebsd.org (8.11.4/8.11.4) id f7ELurE44643;
	Tue, 14 Aug 2001 14:56:54 -0700 (PDT)
	(envelope-from wpaul)
Message-Id: <200108142156.f7ELurE44643@freefall.freebsd.org>
From: Bill Paul <wpaul@FreeBSD.org>
Date: Tue, 14 Aug 2001 14:56:53 -0700 (PDT)
To: cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org
Subject: cvs commit: src/sys/alpha/alpha busdma_machdep.c
X-FreeBSD-CVS-Branch: HEAD
Sender: owner-cvs-all@FreeBSD.ORG
Precedence: bulk
List-ID: <cvs-all.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20cvs-all>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20cvs-all>
X-Loop: FreeBSD.ORG

wpaul       2001/08/14 14:56:53 PDT

  Modified files:
    sys/alpha/alpha      busdma_machdep.c 
  Log:
  Fix yet another "unconditionally free()ing memory without even checking
  to see if it was malloc()ed first" bug. In bus_dmamap_create(), one of
  two things can happen: either we need to allocate a special map due to
  some manner of bounce buffering requirement, or we can DMA a buffer
  in place. On the x86 platform, the "in place" case results in
  bus_dmamap_create() returning a dmamap of NULL. The bus_dmamap_destroy()
  routine later checks for NULL and won't bother free()ing the map if
  it detects this condition.
  
  But on the alpha, we don't use NULL, we use a statically allocated map
  called nobounce_dmamap(). Unfortunately, bus_dmamap_destroy() does not
  handle the condition where we attempt to destroy such a map: it tries
  to free() the dmamap, which causes a panic.
  
  Fix: test that map != &nobounce_dmamap before trying to free() it.
  
  With this fix, my busdma-ified if_sis driver works on the alpha. I'm
  a bit alarmed that I'm the first person ever to trip over this bug, since
  we have been using busdma on the alpha for a while, and since it sort
  of screams out "Hi! I'm a bug! Booga-booga!" when you look at it.
  
  (Somewhere, somebody will say: "But Bill, why don't you just not bother
  destroying the maps in this case." Because the API is supposed to be
  a) symetrical and b) opaque to the caller. I can't know whether it's safe
  to skip the bus_dmamap_destroy() step or not without sticking my fingers
  into unsafe places, which is what I wanted to avoid in the first place.)
  
  Revision  Changes    Path
  1.19      +8 -2      src/sys/alpha/alpha/busdma_machdep.c


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe cvs-all" in the body of the message