On Mon, Jan 06, 2014 at 03:48:32AM +0000, Adrian Chadd wrote: > Author: adrian > Date: Mon Jan 6 03:48:32 2014 > New Revision: 260363 > URL: http://svnweb.freebsd.org/changeset/base/260363 > > Log: > Correctly remove entries from the relevant receive ath_buf list before > freeing them. > > The current code would walk the list and call the buffer free, which > didn't remove it from any lists before pushing it back on the free list. > > Tested: AR9485, STA mode > > Noticed by: dil...@apollo.dragonflybsd.org This is a NOP, right ?
>
> Modified:
> head/sys/dev/ath/if_ath_rx_edma.c
>
> Modified: head/sys/dev/ath/if_ath_rx_edma.c
> ==============================================================================
> --- head/sys/dev/ath/if_ath_rx_edma.c Mon Jan 6 01:51:08 2014
> (r260362)
> +++ head/sys/dev/ath/if_ath_rx_edma.c Mon Jan 6 03:48:32 2014
> (r260363)
> @@ -450,18 +450,20 @@ ath_edma_recv_proc_queue(struct ath_soft
> static void
> ath_edma_flush_deferred_queue(struct ath_softc *sc)
> {
> - struct ath_buf *bf, *next;
> + struct ath_buf *bf;
>
> ATH_RX_LOCK_ASSERT(sc);
>
> /* Free in one set, inside the lock */
> - TAILQ_FOREACH_SAFE(bf,
> - &sc->sc_rx_rxlist[HAL_RX_QUEUE_LP], bf_list, next) {
> + while (! TAILQ_EMPTY(&sc->sc_rx_rxlist[HAL_RX_QUEUE_LP])) {
> + bf = TAILQ_FIRST(&sc->sc_rx_rxlist[HAL_RX_QUEUE_LP]);
> + TAILQ_REMOVE(&sc->sc_rx_rxlist[HAL_RX_QUEUE_LP], bf, bf_list);
> /* Free the buffer/mbuf */
> ath_edma_rxbuf_free(sc, bf);
> }
> - TAILQ_FOREACH_SAFE(bf,
> - &sc->sc_rx_rxlist[HAL_RX_QUEUE_HP], bf_list, next) {
> + while (! TAILQ_EMPTY(&sc->sc_rx_rxlist[HAL_RX_QUEUE_HP])) {
> + bf = TAILQ_FIRST(&sc->sc_rx_rxlist[HAL_RX_QUEUE_HP]);
> + TAILQ_REMOVE(&sc->sc_rx_rxlist[HAL_RX_QUEUE_HP], bf, bf_list);
> /* Free the buffer/mbuf */
> ath_edma_rxbuf_free(sc, bf);
> }
> @@ -495,6 +497,10 @@ ath_edma_recv_proc_deferred_queue(struct
> ATH_RX_UNLOCK(sc);
>
> /* Handle the completed descriptors */
> + /*
> + * XXX is this SAFE call needed? The ath_buf entries
> + * aren't modified by ath_rx_pkt, right?
> + */
> TAILQ_FOREACH_SAFE(bf, &rxlist, bf_list, next) {
> /*
> * Skip the RX descriptor status - start at the data offset
> @@ -520,7 +526,9 @@ ath_edma_recv_proc_deferred_queue(struct
>
> /* Free in one set, inside the lock */
> ATH_RX_LOCK(sc);
> - TAILQ_FOREACH_SAFE(bf, &rxlist, bf_list, next) {
> + while (! TAILQ_EMPTY(&rxlist)) {
> + bf = TAILQ_FIRST(&rxlist);
> + TAILQ_REMOVE(&rxlist, bf, bf_list);
> /* Free the buffer/mbuf */
> ath_edma_rxbuf_free(sc, bf);
> }
pgpqVkAk2fw9y.pgp
Description: PGP signature
