d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

This delta fixes two bugs:

Browse Source 
- When a vlan event occurs a check was not made that
    the event was actually for the interface, thus resulting
    in a panic. All three drivers have this vulnerability. Add
    a check for this condition.
  - Secondly, there was a duplicate buf_ring free in the em
    driver resulting in a panic on unload. Remove.

Approved by:  re
This commit is contained in:
jfv 2009-07-24 16:57:49 +00:00
parent a3c94456b5
commit a5f235cd3b
3 changed files with 25 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
sys/dev/e1000/if_em.c
View File

@ -919,9 +919,6 @@ em_detach(device_t dev)
bus_generic_detach(dev);
if_free(ifp);
#if __FreeBSD_version >= 800000
drbr_free(adapter->br, M_DEVBUF);
#endif
em_free_transmit_structures(adapter);
em_free_receive_structures(adapter);
@ -3644,7 +3641,8 @@ em_free_transmit_structures(struct adapter *adapter)
adapter->txtag = NULL;
}
#if __FreeBSD_version >= 800000
buf_ring_free(adapter->br, M_DEVBUF);
if (adapter->br != NULL)
buf_ring_free(adapter->br, M_DEVBUF);
#endif
}
@ -4720,7 +4718,10 @@ em_register_vlan(void *unused, struct ifnet *ifp, u16 vtag)
struct adapter *adapter = ifp->if_softc;
u32 index, bit;
if ((vtag == 0) || (vtag > 4095)) /* Invalid */
if (ifp->if_init != em_init) /* Not our event */
return;
if ((vtag == 0) || (vtag > 4095)) /* Invalid ID */
return;
index = (vtag >> 5) & 0x7F;
@ -4741,6 +4742,9 @@ em_unregister_vlan(void *unused, struct ifnet *ifp, u16 vtag)
struct adapter *adapter = ifp->if_softc;
u32 index, bit;
if (ifp->if_init != em_init)
return;
if ((vtag == 0) || (vtag > 4095)) /* Invalid */
return;

9
sys/dev/e1000/if_igb.c
View File

@ -3068,7 +3068,8 @@ igb_free_transmit_buffers(struct tx_ring *txr)
}
}
#if __FreeBSD_version >= 800000
buf_ring_free(txr->br, M_DEVBUF);
if (txr->br != NULL)
buf_ring_free(txr->br, M_DEVBUF);
#endif
if (txr->tx_buffers != NULL) {
free(txr->tx_buffers, M_DEVBUF);
@ -4309,6 +4310,9 @@ igb_register_vlan(void *unused, struct ifnet *ifp, u16 vtag)
struct adapter *adapter = ifp->if_softc;
u32 index, bit;
if (ifp->if_init != igb_init) /* Not our event */
return;
if ((vtag == 0) || (vtag > 4095)) /* Invalid */
return;
@ -4330,6 +4334,9 @@ igb_unregister_vlan(void *unused, struct ifnet *ifp, u16 vtag)
struct adapter *adapter = ifp->if_softc;
u32 index, bit;
if (ifp->if_init != igb_init)
return;
if ((vtag == 0) || (vtag > 4095)) /* Invalid */
return;

9
sys/dev/ixgbe/ixgbe.c
View File

@ -2961,7 +2961,8 @@ ixgbe_free_transmit_buffers(struct tx_ring *txr)
}
}
#if __FreeBSD_version >= 800000
buf_ring_free(txr->br, M_DEVBUF);
if (txr->br != NULL)
buf_ring_free(txr->br, M_DEVBUF);
#endif
if (txr->tx_buffers != NULL) {
free(txr->tx_buffers, M_DEVBUF);
@ -4128,6 +4129,9 @@ ixgbe_register_vlan(void *unused, struct ifnet *ifp, u16 vtag)
struct adapter *adapter = ifp->if_softc;
u16 index, bit;
if (ifp->if_init != ixgbe_init) /* Not our event */
return;
if ((vtag == 0) || (vtag > 4095)) /* Invalid */
return;
@ -4150,6 +4154,9 @@ ixgbe_unregister_vlan(void *unused, struct ifnet *ifp, u16 vtag)
struct adapter *adapter = ifp->if_softc;
u16 index, bit;
if (ifp->if_init != ixgbe_init)
return;
if ((vtag == 0) || (vtag > 4095)) /* Invalid */
return;