Date: Tue, 4 Jul 2017 00:04:32 +0000 (UTC) From: Zbigniew Bodek <zbb@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r320629 - head/sys/dev/ena Message-ID: <201707040004.v6404WDG082924@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: zbb Date: Tue Jul 4 00:04:31 2017 New Revision: 320629 URL: https://svnweb.freebsd.org/changeset/base/320629 Log: Call drbr_advance() before leaving TX routine If drbr_advance() is not called before doing cleanup and packet is already enqueued for sending (tx_info is holding pointer to mbuf), then mbuf is cleaned both in drbr_flush() and in cleanup routine, when all mbufs hold by tx_buffer_info are being released. This causes panic, because mbuf is released twice. Submitted by: Michal Krawczyk <mk@semihalf.com> Obtained from: Semihalf Sponsored by: Amazon.com Inc. Modified: head/sys/dev/ena/ena.c Modified: head/sys/dev/ena/ena.c ============================================================================== --- head/sys/dev/ena/ena.c Tue Jul 4 00:02:28 2017 (r320628) +++ head/sys/dev/ena/ena.c Tue Jul 4 00:04:31 2017 (r320629) @@ -2805,10 +2805,11 @@ ena_start_xmit(struct ena_ring *tx_ring) break; } + drbr_advance(adapter->ifp, tx_ring->br); + if ((adapter->ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) return; - drbr_advance(adapter->ifp, tx_ring->br); acum_pkts++; BPF_MTAP(adapter->ifp, mbuf);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201707040004.v6404WDG082924>