Page Menu
Home
FreeBSD
Search
Configure Global Search
Log In
Files
F159134306
D18342.id.diff
No One
Temporary
Actions
View File
Edit File
Delete File
View Transforms
Subscribe
Mute Notifications
Flag For Later
Award Token
Size
3 KB
Referenced Files
None
Subscribers
None
D18342.id.diff
View Options
Index: head/sys/dev/bwn/if_bwn.c
===================================================================
--- head/sys/dev/bwn/if_bwn.c
+++ head/sys/dev/bwn/if_bwn.c
@@ -209,7 +209,7 @@
static void bwn_pio_rx_write_4(struct bwn_pio_rxqueue *, uint16_t,
uint32_t);
static int bwn_pio_tx_start(struct bwn_mac *, struct ieee80211_node *,
- struct mbuf *);
+ struct mbuf **);
static struct bwn_pio_txqueue *bwn_pio_select(struct bwn_mac *, uint8_t);
static uint32_t bwn_pio_write_multi_4(struct bwn_mac *,
struct bwn_pio_txqueue *, uint32_t, const void *, int);
@@ -273,7 +273,7 @@
static void bwn_dma_handle_txeof(struct bwn_mac *,
const struct bwn_txstatus *);
static int bwn_dma_tx_start(struct bwn_mac *, struct ieee80211_node *,
- struct mbuf *);
+ struct mbuf **);
static int bwn_dma_getslot(struct bwn_dma_ring *);
static struct bwn_dma_ring *bwn_dma_select(struct bwn_mac *,
uint8_t);
@@ -1068,7 +1068,7 @@
}
error = (mac->mac_flags & BWN_MAC_FLAG_DMA) ?
- bwn_dma_tx_start(mac, ni, m) : bwn_pio_tx_start(mac, ni, m);
+ bwn_dma_tx_start(mac, ni, &m) : bwn_pio_tx_start(mac, ni, &m);
if (error) {
m_freem(m);
return (error);
@@ -1077,13 +1077,14 @@
}
static int
-bwn_pio_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
+bwn_pio_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni,
+ struct mbuf **mp)
{
struct bwn_pio_txpkt *tp;
- struct bwn_pio_txqueue *tq = bwn_pio_select(mac, M_WME_GETAC(m));
+ struct bwn_pio_txqueue *tq;
struct bwn_softc *sc = mac->mac_sc;
struct bwn_txhdr txhdr;
- struct mbuf *m_new;
+ struct mbuf *m, *m_new;
uint32_t ctl32;
int error;
uint16_t ctl16;
@@ -1092,6 +1093,8 @@
/* XXX TODO send packets after DTIM */
+ m = *mp;
+ tq = bwn_pio_select(mac, M_WME_GETAC(m));
KASSERT(!TAILQ_EMPTY(&tq->tq_pktlist), ("%s: fail", __func__));
tp = TAILQ_FIRST(&tq->tq_pktlist);
tp->tp_ni = ni;
@@ -1111,13 +1114,14 @@
/*
* XXX please removes m_defrag(9)
*/
- m_new = m_defrag(m, M_NOWAIT);
+ m_new = m_defrag(*mp, M_NOWAIT);
if (m_new == NULL) {
device_printf(sc->sc_dev,
"%s: can't defrag TX buffer\n",
__func__);
return (ENOBUFS);
}
+ *mp = m_new;
if (m_new->m_next != NULL)
device_printf(sc->sc_dev,
"TODO: fragmented packets for PIO\n");
@@ -1168,15 +1172,17 @@
}
static int
-bwn_dma_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
+bwn_dma_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni,
+ struct mbuf **mp)
{
#define BWN_GET_TXHDRCACHE(slot) \
&(txhdr_cache[(slot / BWN_TX_SLOTS_PER_FRAME) * BWN_HDRSIZE(mac)])
struct bwn_dma *dma = &mac->mac_method.dma;
- struct bwn_dma_ring *dr = bwn_dma_select(mac, M_WME_GETAC(m));
+ struct bwn_dma_ring *dr = bwn_dma_select(mac, M_WME_GETAC(*mp));
struct bwn_dmadesc_generic *desc;
struct bwn_dmadesc_meta *mt;
struct bwn_softc *sc = mac->mac_sc;
+ struct mbuf *m;
uint8_t *txhdr_cache = (uint8_t *)dr->dr_txhdr_cache;
int error, slot, backup[2] = { dr->dr_curslot, dr->dr_usedslot };
@@ -1185,6 +1191,7 @@
/* XXX send after DTIM */
+ m = *mp;
slot = bwn_dma_getslot(dr);
dr->getdesc(dr, slot, &desc, &mt);
KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_HEADER,
@@ -1233,9 +1240,8 @@
__func__);
error = ENOBUFS;
goto fail;
- } else {
- m = m_new;
}
+ *mp = m = m_new;
mt->mt_m = m;
error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap,
File Metadata
Details
Attached
Mime Type
text/plain
Expires
Thu, Jun 11, 12:07 PM (2 h, 16 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
33878272
Default Alt Text
D18342.id.diff (3 KB)
Attached To
Mode
D18342: Fix possible double free in bwn_{dma,pio}_tx_start().
Attached
Detach File
Event Timeline
Log In to Comment