Author: hselasky
Date: Fri Sep 16 11:57:48 2016
New Revision: 305877
URL: https://svnweb.freebsd.org/changeset/base/305877
Log:
mlx5en: Fix duplicate mbuf free-by-code.
When mlx5e_sq_xmit() returns an error code and the mbuf pointer is set,
we should not free the mbuf, because the caller will keep the mbuf in
the drbr. Make sure the mbuf pointer is correctly set upon function
exit.
Sponsored by: Mellanox Technologies
MFC after: 1 week
Modified:
head/sys/dev/mlx5/mlx5_en/mlx5_en_tx.c
Modified: head/sys/dev/mlx5/mlx5_en/mlx5_en_tx.c
==============================================================================
--- head/sys/dev/mlx5/mlx5_en/mlx5_en_tx.c Fri Sep 16 11:55:38 2016
(r305876)
+++ head/sys/dev/mlx5/mlx5_en/mlx5_en_tx.c Fri Sep 16 11:57:48 2016
(r305877)
@@ -224,10 +224,8 @@ mlx5e_sq_xmit(struct mlx5e_sq *sq, struc
/* Send one multi NOP message instead of many */
mlx5e_send_nop(sq, (pi + 1) * MLX5_SEND_WQEBB_NUM_DS);
pi = ((~sq->pc) & sq->wq.sz_m1);
- if (pi < (MLX5_SEND_WQE_MAX_WQEBBS - 1)) {
- m_freem(mb);
+ if (pi < (MLX5_SEND_WQE_MAX_WQEBBS - 1))
return (ENOMEM);
- }
}
/* Setup local variables */
@@ -338,10 +336,8 @@ mlx5e_sq_xmit(struct mlx5e_sq *sq, struc
mb, segs, &nsegs, BUS_DMA_NOWAIT);
}
/* Catch errors */
- if (err != 0) {
+ if (err != 0)
goto tx_drop;
- }
- *mbp = mb;
for (x = 0; x != nsegs; x++) {
if (segs[x].ds_len == 0)
@@ -374,6 +370,7 @@ skip_dma:
bus_dmamap_sync(sq->dma_tag, sq->mbuf[pi].dma_map,
BUS_DMASYNC_PREWRITE);
sq->stats.packets++;
+ *mbp = NULL; /* safety clear */
return (0);
tx_drop:
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
