From owner-svn-src-all@FreeBSD.ORG Sun Jan 2 10:01:30 2011 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 66E8C1065693; Sun, 2 Jan 2011 10:01:30 +0000 (UTC) (envelope-from bschmidt@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 3BABF8FC0A; Sun, 2 Jan 2011 10:01:30 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id p02A1Ubr040819; Sun, 2 Jan 2011 10:01:30 GMT (envelope-from bschmidt@svn.freebsd.org) Received: (from bschmidt@localhost) by svn.freebsd.org (8.14.3/8.14.3/Submit) id p02A1UUk040817; Sun, 2 Jan 2011 10:01:30 GMT (envelope-from bschmidt@svn.freebsd.org) Message-Id: <201101021001.p02A1UUk040817@svn.freebsd.org> From: Bernhard Schmidt Date: Sun, 2 Jan 2011 10:01:30 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-releng@freebsd.org X-SVN-Group: releng MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r216886 - releng/8.2/sys/dev/wpi X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 02 Jan 2011 10:01:30 -0000 Author: bschmidt Date: Sun Jan 2 10:01:29 2011 New Revision: 216886 URL: http://svn.freebsd.org/changeset/base/216886 Log: MFC r216824: The RX path is missing a few bus_dmamap_*() calls, this results in modification of memory which was already free'd and eventually in: wpi0: could not map mbuf (error 12) wpi0: wpi_rx_intr: bus_dmamap_load failed, error 12 and an usuable device. PR: kern/144898 Approved by: re (kib) Modified: releng/8.2/sys/dev/wpi/if_wpi.c Directory Properties: releng/8.2/sys/ (props changed) releng/8.2/sys/amd64/include/xen/ (props changed) releng/8.2/sys/cddl/contrib/opensolaris/ (props changed) releng/8.2/sys/contrib/dev/acpica/ (props changed) releng/8.2/sys/contrib/pf/ (props changed) Modified: releng/8.2/sys/dev/wpi/if_wpi.c ============================================================================== --- releng/8.2/sys/dev/wpi/if_wpi.c Sun Jan 2 09:03:53 2011 (r216885) +++ releng/8.2/sys/dev/wpi/if_wpi.c Sun Jan 2 10:01:29 2011 (r216886) @@ -1052,9 +1052,18 @@ wpi_free_rx_ring(struct wpi_softc *sc, s wpi_dma_contig_free(&ring->desc_dma); - for (i = 0; i < WPI_RX_RING_COUNT; i++) - if (ring->data[i].m != NULL) - m_freem(ring->data[i].m); + for (i = 0; i < WPI_RX_RING_COUNT; i++) { + struct wpi_rx_data *data = &ring->data[i]; + + if (data->m != NULL) { + bus_dmamap_sync(ring->data_dmat, data->map, + BUS_DMASYNC_POSTREAD); + bus_dmamap_unload(ring->data_dmat, data->map); + m_freem(data->m); + } + if (data->map != NULL) + bus_dmamap_destroy(ring->data_dmat, data->map); + } } static int @@ -1461,6 +1470,7 @@ wpi_rx_intr(struct wpi_softc *sc, struct return; } + bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_POSTREAD); head = (struct wpi_rx_head *)((caddr_t)(stat + 1) + stat->len); tail = (struct wpi_rx_tail *)((caddr_t)(head + 1) + le16toh(head->len)); @@ -1491,6 +1501,8 @@ wpi_rx_intr(struct wpi_softc *sc, struct ifp->if_ierrors++; return; } + bus_dmamap_unload(ring->data_dmat, data->map); + error = bus_dmamap_load(ring->data_dmat, data->map, mtod(mnew, caddr_t), MJUMPAGESIZE, wpi_dma_map_addr, &paddr, BUS_DMA_NOWAIT);