diff --git a/sys/dev/qlxgbe/ql_hw.c b/sys/dev/qlxgbe/ql_hw.c index 03bb9260f3c2..e6efba6e62af 100644 --- a/sys/dev/qlxgbe/ql_hw.c +++ b/sys/dev/qlxgbe/ql_hw.c @@ -2374,6 +2374,16 @@ ql_hw_send(qla_host_t *ha, bus_dma_segment_t *segs, int nsegs, } } + for (i = 0; i < num_tx_cmds; i++) { + if (NULL != ha->tx_ring[txr_idx].tx_buf[(tx_idx+i)].m_head) { + QL_ASSERT(ha, 0, \ + ("%s: txr_idx = %d tx_idx = %d mbuf = %p\n",\ + __func__, txr_idx, (tx_idx+i),\ + ha->tx_ring[txr_idx].tx_buf[(tx_idx+i)].m_head)); + return (EINVAL); + } + } + tx_cmd = &hw->tx_cntxt[txr_idx].tx_ring_base[tx_idx]; if (!(mp->m_pkthdr.csum_flags & CSUM_TSO)) { diff --git a/sys/dev/qlxgbe/ql_os.c b/sys/dev/qlxgbe/ql_os.c index c4391a1b9871..bd17252b3c4c 100644 --- a/sys/dev/qlxgbe/ql_os.c +++ b/sys/dev/qlxgbe/ql_os.c @@ -1232,6 +1232,17 @@ qla_send(qla_host_t *ha, struct mbuf **m_headp, uint32_t txr_idx, QL_DPRINT8(ha, (ha->pci_dev, "%s: enter\n", __func__)); tx_idx = ha->hw.tx_cntxt[txr_idx].txr_next; + + if (NULL != ha->tx_ring[txr_idx].tx_buf[tx_idx].m_head) { + QL_ASSERT(ha, 0, ("%s: txr_idx = %d tx_idx = %d mbuf = %p\n",\ + __func__, txr_idx, tx_idx,\ + ha->tx_ring[txr_idx].tx_buf[tx_idx].m_head)); + if (m_head) + m_freem(m_head); + *m_headp = NULL; + return (ret); + } + map = ha->tx_ring[txr_idx].tx_buf[tx_idx].map; ret = bus_dmamap_load_mbuf_sg(ha->tx_tag, map, m_head, segs, &nsegs,