From owner-svn-src-all@FreeBSD.ORG Fri Jul 24 16:57:50 2009 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 9DB02106564A; Fri, 24 Jul 2009 16:57:50 +0000 (UTC) (envelope-from jfv@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 8B44A8FC19; Fri, 24 Jul 2009 16:57:50 +0000 (UTC) (envelope-from jfv@FreeBSD.org) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id n6OGvoNM015884; Fri, 24 Jul 2009 16:57:50 GMT (envelope-from jfv@svn.freebsd.org) Received: (from jfv@localhost) by svn.freebsd.org (8.14.3/8.14.3/Submit) id n6OGvoQX015880; Fri, 24 Jul 2009 16:57:50 GMT (envelope-from jfv@svn.freebsd.org) Message-Id: <200907241657.n6OGvoQX015880@svn.freebsd.org> From: Jack F Vogel Date: Fri, 24 Jul 2009 16:57:50 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r195851 - in head/sys/dev: e1000 ixgbe X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jul 2009 16:57:51 -0000 Author: jfv Date: Fri Jul 24 16:57:49 2009 New Revision: 195851 URL: http://svn.freebsd.org/changeset/base/195851 Log: This delta fixes two bugs: - When a vlan event occurs a check was not made that the event was actually for the interface, thus resulting in a panic. All three drivers have this vulnerability. Add a check for this condition. - Secondly, there was a duplicate buf_ring free in the em driver resulting in a panic on unload. Remove. Approved by: re Modified: head/sys/dev/e1000/if_em.c head/sys/dev/e1000/if_igb.c head/sys/dev/ixgbe/ixgbe.c Modified: head/sys/dev/e1000/if_em.c ============================================================================== --- head/sys/dev/e1000/if_em.c Fri Jul 24 16:54:22 2009 (r195850) +++ head/sys/dev/e1000/if_em.c Fri Jul 24 16:57:49 2009 (r195851) @@ -919,9 +919,6 @@ em_detach(device_t dev) bus_generic_detach(dev); if_free(ifp); -#if __FreeBSD_version >= 800000 - drbr_free(adapter->br, M_DEVBUF); -#endif em_free_transmit_structures(adapter); em_free_receive_structures(adapter); @@ -3644,7 +3641,8 @@ em_free_transmit_structures(struct adapt adapter->txtag = NULL; } #if __FreeBSD_version >= 800000 - buf_ring_free(adapter->br, M_DEVBUF); + if (adapter->br != NULL) + buf_ring_free(adapter->br, M_DEVBUF); #endif } @@ -4720,7 +4718,10 @@ em_register_vlan(void *unused, struct if struct adapter *adapter = ifp->if_softc; u32 index, bit; - if ((vtag == 0) || (vtag > 4095)) /* Invalid */ + if (ifp->if_init != em_init) /* Not our event */ + return; + + if ((vtag == 0) || (vtag > 4095)) /* Invalid ID */ return; index = (vtag >> 5) & 0x7F; @@ -4741,6 +4742,9 @@ em_unregister_vlan(void *unused, struct struct adapter *adapter = ifp->if_softc; u32 index, bit; + if (ifp->if_init != em_init) + return; + if ((vtag == 0) || (vtag > 4095)) /* Invalid */ return; Modified: head/sys/dev/e1000/if_igb.c ============================================================================== --- head/sys/dev/e1000/if_igb.c Fri Jul 24 16:54:22 2009 (r195850) +++ head/sys/dev/e1000/if_igb.c Fri Jul 24 16:57:49 2009 (r195851) @@ -3068,7 +3068,8 @@ igb_free_transmit_buffers(struct tx_ring } } #if __FreeBSD_version >= 800000 - buf_ring_free(txr->br, M_DEVBUF); + if (txr->br != NULL) + buf_ring_free(txr->br, M_DEVBUF); #endif if (txr->tx_buffers != NULL) { free(txr->tx_buffers, M_DEVBUF); @@ -4309,6 +4310,9 @@ igb_register_vlan(void *unused, struct i struct adapter *adapter = ifp->if_softc; u32 index, bit; + if (ifp->if_init != igb_init) /* Not our event */ + return; + if ((vtag == 0) || (vtag > 4095)) /* Invalid */ return; @@ -4330,6 +4334,9 @@ igb_unregister_vlan(void *unused, struct struct adapter *adapter = ifp->if_softc; u32 index, bit; + if (ifp->if_init != igb_init) + return; + if ((vtag == 0) || (vtag > 4095)) /* Invalid */ return; Modified: head/sys/dev/ixgbe/ixgbe.c ============================================================================== --- head/sys/dev/ixgbe/ixgbe.c Fri Jul 24 16:54:22 2009 (r195850) +++ head/sys/dev/ixgbe/ixgbe.c Fri Jul 24 16:57:49 2009 (r195851) @@ -2961,7 +2961,8 @@ ixgbe_free_transmit_buffers(struct tx_ri } } #if __FreeBSD_version >= 800000 - buf_ring_free(txr->br, M_DEVBUF); + if (txr->br != NULL) + buf_ring_free(txr->br, M_DEVBUF); #endif if (txr->tx_buffers != NULL) { free(txr->tx_buffers, M_DEVBUF); @@ -4128,6 +4129,9 @@ ixgbe_register_vlan(void *unused, struct struct adapter *adapter = ifp->if_softc; u16 index, bit; + if (ifp->if_init != ixgbe_init) /* Not our event */ + return; + if ((vtag == 0) || (vtag > 4095)) /* Invalid */ return; @@ -4150,6 +4154,9 @@ ixgbe_unregister_vlan(void *unused, stru struct adapter *adapter = ifp->if_softc; u16 index, bit; + if (ifp->if_init != ixgbe_init) + return; + if ((vtag == 0) || (vtag > 4095)) /* Invalid */ return;