Date: Sat, 12 Mar 2005 16:20:04 GMT From: Tai-hwa Liang <avatar@mmlab.cse.yzu.edu.tw> To: freebsd-bugs@FreeBSD.org Subject: Re: kern/77804: [patch] Fix reusing freed memory in if_bfe.c in 6-CURRENT Message-ID: <200503121620.j2CGK4ek022999@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
The following reply was made to PR kern/77804; it has been noted by GNATS.
From: Tai-hwa Liang <avatar@mmlab.cse.yzu.edu.tw>
To: freebsd-gnats-submit@FreeBSD.org
Cc: frank@exit.com
Subject: Re: kern/77804: [patch] Fix reusing freed memory in if_bfe.c in
6-CURRENT
Date: Sun, 13 Mar 2005 00:01:55 +0800 (CST)
Hi Frank,
After discussed with dmlb@ and sam@, we agree that your patch is
needed; however, would you please test following patch again since
this one makes a different assumption on the number of TX/RX descriptors?
--- if_bfe.c.orig Mon Jan 10 03:57:55 2005
+++ if_bfe.c Sat Mar 12 23:52:10 2005
@@ -541,8 +541,6 @@
sc->bfe_tx_ring[i].bfe_mbuf = NULL;
bus_dmamap_unload(sc->bfe_tag,
sc->bfe_tx_ring[i].bfe_map);
- bus_dmamap_destroy(sc->bfe_tag,
- sc->bfe_tx_ring[i].bfe_map);
}
}
bzero(sc->bfe_tx_list, BFE_TX_LIST_SIZE);
@@ -560,15 +558,12 @@
sc->bfe_rx_ring[i].bfe_mbuf = NULL;
bus_dmamap_unload(sc->bfe_tag,
sc->bfe_rx_ring[i].bfe_map);
- bus_dmamap_destroy(sc->bfe_tag,
- sc->bfe_rx_ring[i].bfe_map);
}
}
bzero(sc->bfe_rx_list, BFE_RX_LIST_SIZE);
bus_dmamap_sync(sc->bfe_rx_tag, sc->bfe_rx_map, BUS_DMASYNC_PREREAD);
}
-
static int
bfe_list_rx_init(struct bfe_softc *sc)
{
@@ -975,6 +970,10 @@
for(i = 0; i < BFE_TX_LIST_CNT; i++) {
bus_dmamap_destroy(sc->bfe_tag,
sc->bfe_tx_ring[i].bfe_map);
+ }
+ for(i = 0; i < BFE_RX_LIST_CNT; i++) {
+ bus_dmamap_destroy(sc->bfe_tag,
+ sc->bfe_rx_ring[i].bfe_map);
}
bus_dma_tag_destroy(sc->bfe_tag);
sc->bfe_tag = NULL;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200503121620.j2CGK4ek022999>