[src/netbsd-6-1]: src/sys/dev/ic Pull up following revision(s) (requested by ...

[snj <snj%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/d8aac5321f7c
branches:  netbsd-6-1
changeset: 776235:d8aac5321f7c
user:      snj <snj%NetBSD.org@localhost>
date:      Fri Aug 18 15:03:03 2017 +0000

description:
Pull up following revision(s) (requested by mrg in ticket #1475):
        sys/dev/ic/i82596.c: revision 1.37
Null out sc_rx_mbuf[i] after m_freem to avoid double-free later.
>From Ilja Van Sprundel.
Also null out sc_tx_mbuf[i] after m_freem, out of paranoia.
XXX Not entirely clear to how tx mbufs are freed, but no way to test
this since it's ews4800mips- and hp700-only, so not keen to make any
more elaborate changes...

diffstat:

 sys/dev/ic/i82596.c |  10 ++++++++--
 1 files changed, 8 insertions(+), 2 deletions(-)

diffs (66 lines):

diff -r 2b64a3efa557 -r d8aac5321f7c sys/dev/ic/i82596.c
--- a/sys/dev/ic/i82596.c       Fri Aug 18 15:00:32 2017 +0000
+++ b/sys/dev/ic/i82596.c       Fri Aug 18 15:03:03 2017 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: i82596.c,v 1.29 2010/04/05 07:19:35 joerg Exp $ */
+/* $NetBSD: i82596.c,v 1.29.28.1 2017/08/18 15:03:03 snj Exp $ */
 
 /*
  * Copyright (c) 2003 Jochen Kunz.
@@ -43,7 +43,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: i82596.c,v 1.29 2010/04/05 07:19:35 joerg Exp $");
+__KERNEL_RCSID(0, "$NetBSD: i82596.c,v 1.29.28.1 2017/08/18 15:03:03 snj Exp $");
 
 /* autoconfig and device stuff */
 #include <sys/param.h>
@@ -754,6 +754,7 @@
                                printf("%s: iee_start: can't allocate mbuf\n",
                                    device_xname(sc->sc_dev));
                                m_freem(sc->sc_tx_mbuf[t]);
+                               sc->sc_tx_mbuf[t] = NULL;
                                t--;
                                continue;
                        }
@@ -763,6 +764,7 @@
                                printf("%s: iee_start: can't allocate mbuf "
                                    "cluster\n", device_xname(sc->sc_dev));
                                m_freem(sc->sc_tx_mbuf[t]);
+                               sc->sc_tx_mbuf[t] = NULL;
                                m_freem(m);
                                t--;
                                continue;
@@ -778,6 +780,7 @@
                                printf("%s: iee_start: can't load TX DMA map\n",
                                    device_xname(sc->sc_dev));
                                m_freem(sc->sc_tx_mbuf[t]);
+                               sc->sc_tx_mbuf[t] = NULL;
                                t--;
                                continue;
                        }
@@ -927,6 +930,7 @@
                                printf("%s: iee_init: can't allocate mbuf"
                                    " cluster\n", device_xname(sc->sc_dev));
                                m_freem(sc->sc_rx_mbuf[r]);
+                               sc->sc_rx_mbuf[r] = NULL;
                                err = 1;
                                break;
                        }
@@ -940,6 +944,7 @@
                                printf("%s: iee_init: can't create RX "
                                    "DMA map\n", device_xname(sc->sc_dev));
                                m_freem(sc->sc_rx_mbuf[r]);
+                               sc->sc_rx_mbuf[r] = NULL;
                                err = 1;
                                break;
                        }
@@ -949,6 +954,7 @@
                            device_xname(sc->sc_dev));
                        bus_dmamap_destroy(sc->sc_dmat, sc->sc_rx_map[r]);
                        m_freem(sc->sc_rx_mbuf[r]);
+                       sc->sc_rx_mbuf[r] = NULL;
                        err = 1;
                        break;
                }