Fix a double-free of mbufs in rx_ixgbe_discard().
fmp->buf at the free point is already part of the chain being freed, so double-freeing is counter-productive. Submitted by: Marc De La Gueronniere <mdelagueronniere@verisign.com> MFC after: 1 week Sponsored by: Verisign, Inc.
This commit is contained in:
parent
1c2427605c
commit
5894690d0d
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=271647
@ -4523,11 +4523,6 @@ ixgbe_rx_discard(struct rx_ring *rxr, int i)
|
||||
|
||||
rbuf = &rxr->rx_buffers[i];
|
||||
|
||||
if (rbuf->fmp != NULL) {/* Partial chain ? */
|
||||
rbuf->fmp->m_flags |= M_PKTHDR;
|
||||
m_freem(rbuf->fmp);
|
||||
rbuf->fmp = NULL;
|
||||
}
|
||||
|
||||
/*
|
||||
** With advanced descriptors the writeback
|
||||
@ -4536,7 +4531,13 @@ ixgbe_rx_discard(struct rx_ring *rxr, int i)
|
||||
** the normal refresh path to get new buffers
|
||||
** and mapping.
|
||||
*/
|
||||
if (rbuf->buf) {
|
||||
|
||||
if (rbuf->fmp != NULL) {/* Partial chain ? */
|
||||
rbuf->fmp->m_flags |= M_PKTHDR;
|
||||
m_freem(rbuf->fmp);
|
||||
rbuf->fmp = NULL;
|
||||
rbuf->buf = NULL; /* rbuf->buf is part of fmp's chain */
|
||||
} else if (rbuf->buf) {
|
||||
m_free(rbuf->buf);
|
||||
rbuf->buf = NULL;
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user