Page MenuHomeFreeBSD

fwip: Fix M_PKTHDR loss in fwip_async_output broadcast path
AcceptedPublic

Authored by guest-seuros on Sun, Jun 7, 12:50 PM.
Referenced Files
Unknown Object (File)
Tue, Jun 23, 12:39 AM
Unknown Object (File)
Sun, Jun 21, 12:28 PM
Unknown Object (File)
Sun, Jun 21, 12:23 PM
Unknown Object (File)
Sat, Jun 20, 1:01 AM
Unknown Object (File)
Sat, Jun 20, 1:00 AM
Unknown Object (File)
Fri, Jun 19, 2:17 PM
Unknown Object (File)
Fri, Jun 19, 2:14 PM
Unknown Object (File)
Wed, Jun 17, 2:29 AM
Subscribers
None

Details

Summary

M_PREPEND in the broadcast branch may call m_prepend(9) which allocates
a new head mbuf and calls m_move_pkthdr(), stripping M_PKTHDR from the
old mbuf.

xfer->mbuf was set before M_PREPEND, so it pointed at the
deheadered old mbuf. bus_dmamap_load_mbuf(9) asserts M_PKTHDR and
panics.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 73733
Build 70616: arc lint + arc unit

Event Timeline

guest-seuros created this revision.
This revision is now accepted and ready to land.Mon, Jun 8, 3:54 AM

Looks sane to me.

sys/dev/firewire/if_fwip.c
602

So that we do not need the previous assignment xfer->mbuf = NULL.

666

A nit here.

zlei retitled this revision from fix(fwip): fix M_PKTHDR loss in fwip_async_output broadcast path to fwip: Fix M_PKTHDR loss in fwip_async_output broadcast path.Mon, Jun 8, 7:37 AM