fwip: Fix M_PKTHDR loss in fwip_async_output broadcast path
ClosedPublic
Actions

Authored by seuros on Jun 7 2026, 12:50 PM.

Details

Reviewers

adrian
imp
ngie
zlei

Commits

rG22ddc9eb1d7a: fwip: Fix M_PKTHDR loss in fwip_async_output broadcast path

Summary

M_PREPEND in the broadcast branch may call m_prepend(9) which allocates
a new head mbuf and calls m_move_pkthdr(), stripping M_PKTHDR from the
old mbuf.

xfer->mbuf was set before M_PREPEND, so it pointed at the
deheadered old mbuf. bus_dmamap_load_mbuf(9) asserts M_PKTHDR and
panics.

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

seuros requested review of this revision.Jun 7 2026, 12:50 PM

seuros created this revision.

Harbormaster completed remote builds in B73733: Diff 179363.Jun 7 2026, 12:50 PM

seuros added projects: firewire, drivers.Jun 7 2026, 3:17 PM

seuros added a reviewer: zlei.Jun 8 2026, 3:38 AM

oh good catch!

adrian accepted this revision.Jun 8 2026, 3:54 AM

This revision is now accepted and ready to land.Jun 8 2026, 3:54 AM

Looks sane to me.

sys/dev/firewire/if_fwip.c
562–568	So that we do not need the previous assignment `xfer->mbuf = NULL`.
626	A nit here.

zlei retitled this revision from fix(fwip): fix M_PKTHDR loss in fwip_async_output broadcast path to fwip: Fix M_PKTHDR loss in fwip_async_output broadcast path.Jun 8 2026, 7:37 AM

Closed by commit rG22ddc9eb1d7a: fwip: Fix M_PKTHDR loss in fwip_async_output broadcast path (authored by seuros, committed by adrian). · Explain WhyJul 5 2026, 6:34 PM

This revision was automatically updated to reflect the committed changes.

adrian added a commit: rG22ddc9eb1d7a: fwip: Fix M_PKTHDR loss in fwip_async_output broadcast path.