From owner-freebsd-bugs@FreeBSD.ORG  Sat Mar 12 16:20:05 2005
Return-Path: <owner-freebsd-bugs@FreeBSD.ORG>
Delivered-To: freebsd-bugs@hub.freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 30BD216A4CF
	for <freebsd-bugs@hub.freebsd.org>;
	Sat, 12 Mar 2005 16:20:05 +0000 (GMT)
Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 0847F43D70
	for <freebsd-bugs@hub.freebsd.org>;
	Sat, 12 Mar 2005 16:20:05 +0000 (GMT)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1])
	by freefall.freebsd.org (8.13.3/8.13.3) with ESMTP id j2CGK4VU023000
	for <freebsd-bugs@freefall.freebsd.org>; Sat, 12 Mar 2005 16:20:04 GMT
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.13.3/8.13.1/Submit) id j2CGK4ek022999;
	Sat, 12 Mar 2005 16:20:04 GMT
	(envelope-from gnats)
Date: Sat, 12 Mar 2005 16:20:04 GMT
Message-Id: <200503121620.j2CGK4ek022999@freefall.freebsd.org>
To: freebsd-bugs@FreeBSD.org
From: Tai-hwa Liang <avatar@mmlab.cse.yzu.edu.tw>
Subject: Re: kern/77804: [patch] Fix reusing freed memory in if_bfe.c in
 6-CURRENT
X-BeenThere: freebsd-bugs@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
Reply-To: Tai-hwa Liang <avatar@mmlab.cse.yzu.edu.tw>
List-Id: Bug reports <freebsd-bugs.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-bugs>
List-Post: <mailto:freebsd-bugs@freebsd.org>
List-Help: <mailto:freebsd-bugs-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
	<mailto:freebsd-bugs-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 12 Mar 2005 16:20:05 -0000

The following reply was made to PR kern/77804; it has been noted by GNATS.

From: Tai-hwa Liang <avatar@mmlab.cse.yzu.edu.tw>
To: freebsd-gnats-submit@FreeBSD.org
Cc: frank@exit.com
Subject: Re: kern/77804: [patch] Fix reusing freed memory in if_bfe.c in
 6-CURRENT
Date: Sun, 13 Mar 2005 00:01:55 +0800 (CST)

 Hi Frank,
 
    After discussed with dmlb@ and sam@, we agree that your patch is
 needed; however, would you please test following patch again since
 this one makes a different assumption on the number of TX/RX descriptors?
 
 --- if_bfe.c.orig	Mon Jan 10 03:57:55 2005
 +++ if_bfe.c	Sat Mar 12 23:52:10 2005
 @@ -541,8 +541,6 @@
   			sc->bfe_tx_ring[i].bfe_mbuf = NULL;
   			bus_dmamap_unload(sc->bfe_tag,
   					sc->bfe_tx_ring[i].bfe_map);
 -			bus_dmamap_destroy(sc->bfe_tag,
 -					sc->bfe_tx_ring[i].bfe_map);
   		}
   	}
   	bzero(sc->bfe_tx_list, BFE_TX_LIST_SIZE);
 @@ -560,15 +558,12 @@
   			sc->bfe_rx_ring[i].bfe_mbuf = NULL;
   			bus_dmamap_unload(sc->bfe_tag,
   					sc->bfe_rx_ring[i].bfe_map);
 -			bus_dmamap_destroy(sc->bfe_tag,
 -					sc->bfe_rx_ring[i].bfe_map);
   		}
   	}
   	bzero(sc->bfe_rx_list, BFE_RX_LIST_SIZE);
   	bus_dmamap_sync(sc->bfe_rx_tag, sc->bfe_rx_map, BUS_DMASYNC_PREREAD);
   }
 
 -
   static int
   bfe_list_rx_init(struct bfe_softc *sc)
   {
 @@ -975,6 +970,10 @@
   		for(i = 0; i < BFE_TX_LIST_CNT; i++) {
   			bus_dmamap_destroy(sc->bfe_tag,
   			    sc->bfe_tx_ring[i].bfe_map);
 +		}
 +		for(i = 0; i < BFE_RX_LIST_CNT; i++) {
 +			bus_dmamap_destroy(sc->bfe_tag,
 +			    sc->bfe_rx_ring[i].bfe_map);
   		}
   		bus_dma_tag_destroy(sc->bfe_tag);
   		sc->bfe_tag = NULL;