From b4b2903275ed3588ed584a75ba2977f45de261df Mon Sep 17 00:00:00 2001 From: Zbigniew Bodek Date: Tue, 4 Jul 2017 00:04:31 +0000 Subject: [PATCH] Call drbr_advance() before leaving TX routine If drbr_advance() is not called before doing cleanup and packet is already enqueued for sending (tx_info is holding pointer to mbuf), then mbuf is cleaned both in drbr_flush() and in cleanup routine, when all mbufs hold by tx_buffer_info are being released. This causes panic, because mbuf is released twice. Submitted by: Michal Krawczyk Obtained from: Semihalf Sponsored by: Amazon.com Inc. --- sys/dev/ena/ena.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sys/dev/ena/ena.c b/sys/dev/ena/ena.c index 62ab785fb9a5..a6f025f83d9b 100644 --- a/sys/dev/ena/ena.c +++ b/sys/dev/ena/ena.c @@ -2805,10 +2805,11 @@ ena_start_xmit(struct ena_ring *tx_ring) break; } + drbr_advance(adapter->ifp, tx_ring->br); + if ((adapter->ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) return; - drbr_advance(adapter->ifp, tx_ring->br); acum_pkts++; BPF_MTAP(adapter->ifp, mbuf);