Author: zbb
Date: Tue Jul 4 00:04:31 2017
New Revision: 320629
URL: https://svnweb.freebsd.org/changeset/base/320629
Log:
Call drbr_advance() before leaving TX routine
If drbr_advance() is not called before doing cleanup and packet is
already enqueued for sending (tx_info is holding pointer to mbuf), then
mbuf is cleaned both in drbr_flush() and in cleanup routine, when all
mbufs hold by tx_buffer_info are being released.
This causes panic, because mbuf is released twice.
Submitted by: Michal Krawczyk <m...@semihalf.com>
Obtained from: Semihalf
Sponsored by: Amazon.com Inc.
Modified:
head/sys/dev/ena/ena.c
Modified: head/sys/dev/ena/ena.c
==============================================================================
--- head/sys/dev/ena/ena.c Tue Jul 4 00:02:28 2017 (r320628)
+++ head/sys/dev/ena/ena.c Tue Jul 4 00:04:31 2017 (r320629)
@@ -2805,10 +2805,11 @@ ena_start_xmit(struct ena_ring *tx_ring)
break;
}
+ drbr_advance(adapter->ifp, tx_ring->br);
+
if ((adapter->ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
return;
- drbr_advance(adapter->ifp, tx_ring->br);
acum_pkts++;
BPF_MTAP(adapter->ifp, mbuf);
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
