Author: jfv
Date: Fri Jul 24 16:57:49 2009
New Revision: 195851
URL: http://svn.freebsd.org/changeset/base/195851
Log:
This delta fixes two bugs:
- When a vlan event occurs a check was not made that
the event was actually for the interface, thus resulting
in a panic. All three drivers have this vulnerability. Add
a check for this condition.
- Secondly, there was a duplicate buf_ring free in the em
driver resulting in a panic on unload. Remove.
Approved by: re
Modified:
head/sys/dev/e1000/if_em.c
head/sys/dev/e1000/if_igb.c
head/sys/dev/ixgbe/ixgbe.c
Modified: head/sys/dev/e1000/if_em.c
==============================================================================
--- head/sys/dev/e1000/if_em.c Fri Jul 24 16:54:22 2009 (r195850)
+++ head/sys/dev/e1000/if_em.c Fri Jul 24 16:57:49 2009 (r195851)
@@ -919,9 +919,6 @@ em_detach(device_t dev)
bus_generic_detach(dev);
if_free(ifp);
-#if __FreeBSD_version >= 800000
- drbr_free(adapter->br, M_DEVBUF);
-#endif
em_free_transmit_structures(adapter);
em_free_receive_structures(adapter);
@@ -3644,7 +3641,8 @@ em_free_transmit_structures(struct adapt
adapter->txtag = NULL;
}
#if __FreeBSD_version >= 800000
- buf_ring_free(adapter->br, M_DEVBUF);
+ if (adapter->br != NULL)
+ buf_ring_free(adapter->br, M_DEVBUF);
#endif
}
@@ -4720,7 +4718,10 @@ em_register_vlan(void *unused, struct if
struct adapter *adapter = ifp->if_softc;
u32 index, bit;
- if ((vtag == 0) || (vtag > 4095)) /* Invalid */
+ if (ifp->if_init != em_init) /* Not our event */
+ return;
+
+ if ((vtag == 0) || (vtag > 4095)) /* Invalid ID */
return;
index = (vtag >> 5) & 0x7F;
@@ -4741,6 +4742,9 @@ em_unregister_vlan(void *unused, struct
struct adapter *adapter = ifp->if_softc;
u32 index, bit;
+ if (ifp->if_init != em_init)
+ return;
+
if ((vtag == 0) || (vtag > 4095)) /* Invalid */
return;
Modified: head/sys/dev/e1000/if_igb.c
==============================================================================
--- head/sys/dev/e1000/if_igb.c Fri Jul 24 16:54:22 2009 (r195850)
+++ head/sys/dev/e1000/if_igb.c Fri Jul 24 16:57:49 2009 (r195851)
@@ -3068,7 +3068,8 @@ igb_free_transmit_buffers(struct tx_ring
}
}
#if __FreeBSD_version >= 800000
- buf_ring_free(txr->br, M_DEVBUF);
+ if (txr->br != NULL)
+ buf_ring_free(txr->br, M_DEVBUF);
#endif
if (txr->tx_buffers != NULL) {
free(txr->tx_buffers, M_DEVBUF);
@@ -4309,6 +4310,9 @@ igb_register_vlan(void *unused, struct i
struct adapter *adapter = ifp->if_softc;
u32 index, bit;
+ if (ifp->if_init != igb_init) /* Not our event */
+ return;
+
if ((vtag == 0) || (vtag > 4095)) /* Invalid */
return;
@@ -4330,6 +4334,9 @@ igb_unregister_vlan(void *unused, struct
struct adapter *adapter = ifp->if_softc;
u32 index, bit;
+ if (ifp->if_init != igb_init)
+ return;
+
if ((vtag == 0) || (vtag > 4095)) /* Invalid */
return;
Modified: head/sys/dev/ixgbe/ixgbe.c
==============================================================================
--- head/sys/dev/ixgbe/ixgbe.c Fri Jul 24 16:54:22 2009 (r195850)
+++ head/sys/dev/ixgbe/ixgbe.c Fri Jul 24 16:57:49 2009 (r195851)
@@ -2961,7 +2961,8 @@ ixgbe_free_transmit_buffers(struct tx_ri
}
}
#if __FreeBSD_version >= 800000
- buf_ring_free(txr->br, M_DEVBUF);
+ if (txr->br != NULL)
+ buf_ring_free(txr->br, M_DEVBUF);
#endif
if (txr->tx_buffers != NULL) {
free(txr->tx_buffers, M_DEVBUF);
@@ -4128,6 +4129,9 @@ ixgbe_register_vlan(void *unused, struct
struct adapter *adapter = ifp->if_softc;
u16 index, bit;
+ if (ifp->if_init != ixgbe_init) /* Not our event */
+ return;
+
if ((vtag == 0) || (vtag > 4095)) /* Invalid */
return;
@@ -4150,6 +4154,9 @@ ixgbe_unregister_vlan(void *unused, stru
struct adapter *adapter = ifp->if_softc;
u16 index, bit;
+ if (ifp->if_init != ixgbe_init)
+ return;
+
if ((vtag == 0) || (vtag > 4095)) /* Invalid */
return;
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
