From 77102fd6a23e10d56bb179092b01334a258e2b50 Mon Sep 17 00:00:00 2001 From: Andrew Gallatin Date: Fri, 25 Jan 2019 15:02:18 +0000 Subject: [PATCH] Fix an iflib driver unload panic introduced in r343085 The new loop to sync and unload descriptors was indexed by "i", rather than "j". The panic was caused by "i" being advanced rather than "j", and eventually becoming out of bounds. Reviewed by: kib MFC after: 3 days Sponsored by: Netflix --- sys/net/iflib.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/sys/net/iflib.c b/sys/net/iflib.c index 0e4445a2575a..36adccc51670 100644 --- a/sys/net/iflib.c +++ b/sys/net/iflib.c @@ -2197,17 +2197,17 @@ iflib_rx_sds_free(iflib_rxq_t rxq) fl = &rxq->ifr_fl[i]; if (fl->ifl_desc_tag != NULL) { if (fl->ifl_sds.ifsd_map != NULL) { - for (j = 0; j < fl->ifl_size; i++) { - if (fl->ifl_sds.ifsd_map[i] == + for (j = 0; j < fl->ifl_size; j++) { + if (fl->ifl_sds.ifsd_map[j] == NULL) - continue; + continue; bus_dmamap_sync( fl->ifl_desc_tag, - fl->ifl_sds.ifsd_map[i], + fl->ifl_sds.ifsd_map[j], BUS_DMASYNC_POSTREAD); bus_dmamap_unload( fl->ifl_desc_tag, - fl->ifl_sds.ifsd_map[i]); + fl->ifl_sds.ifsd_map[j]); } } bus_dma_tag_destroy(fl->ifl_desc_tag);