Page MenuHomeFreeBSD

Fix possible double free in bwn_{dma,pio}_tx_start().
ClosedPublic

Authored by markj on Nov 26 2018, 2:37 PM.

Details

Summary

The caller of bwn_{dma,pio}_tx_start() frees the mbuf if the call fails.
The tx_start routines may call m_defrag() which frees the input mbuf
chain upon success; if the routines fail after successfully calling
m_defrag(), we will free the mbuf chain twice.

Test Plan

None; I don't have any hardware which uses this driver.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

markj added a reviewer: landonf.

This looks good to me; I'll try to test on real hardware over the weekend, just to be sure.

This looks good to me; I'll try to test on real hardware over the weekend, just to be sure.

Thanks!

Sorry to nag, but did you get a chance to test this?

Sorry to nag, but did you get a chance to test this?

Apologies, wasn't able to get to it until tonight; other than the small KASSERT ordering issue, everything seems to be fine on a real hardware.

  • Fix assert ordering issue.

Sorry to nag, but did you get a chance to test this?

Apologies, wasn't able to get to it until tonight; other than the small KASSERT ordering issue, everything seems to be fine on a real hardware.

Thanks. Not sure how the assert issue slipped through build testing, but the latest upload fixes it.

This revision is now accepted and ready to land.Dec 12 2018, 5:01 AM
This revision was automatically updated to reflect the committed changes.