d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix a double-free of mbufs in rx_ixgbe_discard().

Browse Source 
fmp->buf at the free point is already part of the chain being freed,
so double-freeing is counter-productive.

Submitted by:	Marc De La Gueronniere <mdelagueronniere@verisign.com>
MFC after:	1 week
Sponsored by:	Verisign, Inc.
This commit is contained in:
Adrian Chadd 2014-09-15 20:50:26 +00:00
parent 1c2427605c
commit 5894690d0d
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=271647
1 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
sys/dev/ixgbe/ixgbe.c
View File

@ -4523,11 +4523,6 @@ ixgbe_rx_discard(struct rx_ring *rxr, int i)
rbuf = &rxr->rx_buffers[i]; rbuf = &rxr->rx_buffers[i];
if (rbuf->fmp != NULL) {/* Partial chain ? */
rbuf->fmp->m_flags |= M_PKTHDR;
m_freem(rbuf->fmp);
rbuf->fmp = NULL;
}
/* /*
** With advanced descriptors the writeback ** With advanced descriptors the writeback
@ -4536,7 +4531,13 @@ ixgbe_rx_discard(struct rx_ring *rxr, int i)
** the normal refresh path to get new buffers ** the normal refresh path to get new buffers
** and mapping. ** and mapping.
*/ */
if (rbuf->buf) {
if (rbuf->fmp != NULL) {/* Partial chain ? */
rbuf->fmp->m_flags |= M_PKTHDR;
m_freem(rbuf->fmp);
rbuf->fmp = NULL;
rbuf->buf = NULL; /* rbuf->buf is part of fmp's chain */
} else if (rbuf->buf) {
m_free(rbuf->buf); m_free(rbuf->buf);
rbuf->buf = NULL; rbuf->buf = NULL;
} }