On Tue, Jun 17, 2008 at 05:07:10AM +0200, Quentin Garnier wrote: > It's a rather easy fix, I'll have a try at it later, unless someone > beats me to it. All other mbuf external storage allocators should be > audited, they're likely to suffer from the same issue as well. Try the attached patch. Beware, not even test-compiled :) -- Quentin Garnier - cube%cubidou.net@localhost - cube%NetBSD.org@localhost "See the look on my face from staying too long in one place [...] every time the morning breaks I know I'm closer to falling" KT Tunstall, Saving My Face, Drastic Fantastic, 2007.
Index: if_sk.c =================================================================== RCS file: /cvsroot/src/sys/dev/pci/if_sk.c,v retrieving revision 1.49 diff -u -r1.49 if_sk.c --- if_sk.c 28 Apr 2008 20:23:55 -0000 1.49 +++ if_sk.c 17 Jun 2008 03:27:30 -0000 @@ -125,6 +125,7 @@ #include <sys/sockio.h> #include <sys/mbuf.h> #include <sys/malloc.h> +#include <sys/mutex.h> #include <sys/kernel.h> #include <sys/socket.h> #include <sys/device.h> @@ -858,6 +859,7 @@ LIST_INIT(&sc_if->sk_jfree_listhead); LIST_INIT(&sc_if->sk_jinuse_listhead); + mutex_init(&sc_if->sk_jpool_mtx, MUTEX_SPIN, IPL_NET); /* * Now divide it up into 9K pieces and save the addresses @@ -912,13 +914,17 @@ { struct sk_jpool_entry *entry; + mutex_enter(&sc_if->sk_jpool_mtx); entry = LIST_FIRST(&sc_if->sk_jfree_listhead); - if (entry == NULL) + if (entry == NULL) { + mutex_leave(&sc_if->sc_jpool_mtx); return NULL; + } LIST_REMOVE(entry, jpool_entries); LIST_INSERT_HEAD(&sc_if->sk_jinuse_listhead, entry, jpool_entries); + mutex_leave(&sc_if->sc_jpool_mtx); return sc_if->sk_cdata.sk_jslots[entry->slot]; } @@ -930,7 +936,7 @@ { struct sk_jpool_entry *entry; struct sk_if_softc *sc; - int i, s; + int i; /* Extract the softc struct pointer. */ sc = (struct sk_if_softc *)arg; @@ -946,17 +952,17 @@ if ((i < 0) || (i >= SK_JSLOTS)) panic("sk_jfree: asked to free buffer that we don't manage!"); - s = splvm(); + mutex_enter(&sc_if->sk_jpool_mtx); entry = LIST_FIRST(&sc->sk_jinuse_listhead); if (entry == NULL) panic("sk_jfree: buffer not in use!"); entry->slot = i; LIST_REMOVE(entry, jpool_entries); LIST_INSERT_HEAD(&sc->sk_jfree_listhead, entry, jpool_entries); + mutex_leave(&sc_if->sc_jpool_mtx); if (__predict_true(m != NULL)) pool_cache_put(mb_cache, m); - splx(s); } /* Index: if_skvar.h =================================================================== RCS file: /cvsroot/src/sys/dev/pci/if_skvar.h,v retrieving revision 1.13 diff -u -r1.13 if_skvar.h --- if_skvar.h 28 Apr 2008 20:23:55 -0000 1.13 +++ if_skvar.h 17 Jun 2008 03:27:30 -0000 @@ -232,6 +232,7 @@ struct sk_softc *sk_softc; /* parent controller */ int sk_tx_bmu; /* TX BMU register */ int sk_if_flags; + kmutex_t sk_jpool_mtx; LIST_HEAD(__sk_jfreehead, sk_jpool_entry) sk_jfree_listhead; LIST_HEAD(__sk_jinusehead, sk_jpool_entry) sk_jinuse_listhead; SIMPLEQ_HEAD(__sk_txmaphead, sk_txmap_entry) sk_txmap_head;
Attachment:
pgpu4WUIGpM9h.pgp
Description: PGP signature