CVS commit: [netbsd-9] src/sys/dev/ic

[Martin Husemann]

Module Name:    src
Committed By:   martin
Date:           Wed Jan  8 11:50:58 UTC 2020

Modified Files:
        src/sys/dev/ic [netbsd-9]: gem.c

Log Message:
Pull up following revision(s) (requested by msaitoh in ticket #610):

        sys/dev/ic/gem.c: revision 1.124

Fix error path in gem(4)'s TX checksum offload.

 - Avoid accessing free'd m0 on error. Use m_freem() instead of m_free().
   Reported by maxv@.
 - Tested by martin@, macallan@ and jdc@.


To generate a diff of this commit:
cvs rdiff -u -r1.120 -r1.120.2.1 src/sys/dev/ic/gem.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.


Modified files:

Index: src/sys/dev/ic/gem.c
diff -u src/sys/dev/ic/gem.c:1.120 src/sys/dev/ic/gem.c:1.120.2.1
--- src/sys/dev/ic/gem.c:1.120	Tue May 28 08:59:34 2019
+++ src/sys/dev/ic/gem.c	Wed Jan  8 11:50:57 2020
@@ -1,4 +1,4 @@
-/*	$NetBSD: gem.c,v 1.120 2019/05/28 08:59:34 msaitoh Exp $ */
+/*	$NetBSD: gem.c,v 1.120.2.1 2020/01/08 11:50:57 martin Exp $ */
 
 /*
  *
@@ -37,7 +37,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: gem.c,v 1.120 2019/05/28 08:59:34 msaitoh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: gem.c,v 1.120.2.1 2020/01/08 11:50:57 martin Exp $");
 
 #include "opt_inet.h"
 
@@ -1389,6 +1389,7 @@ gem_start(struct ifnet *ifp)
 	 * until we drain the queue, or use up all available transmit
 	 * descriptors.
 	 */
+next:
 	while ((txs = SIMPLEQ_FIRST(&sc->sc_txfreeq)) != NULL &&
 	    sc->sc_txfree != 0) {
 		/*
@@ -1498,16 +1499,9 @@ gem_start(struct ifnet *ifp)
 			 * and the checksum stuff if we want the hardware
 			 * to do it.
 			 */
-			sc->sc_txdescs[nexttx].gd_addr =
-			    GEM_DMA_WRITE(sc, dmamap->dm_segs[seg].ds_addr);
 			flags = dmamap->dm_segs[seg].ds_len & GEM_TD_BUFSIZE;
 			if (nexttx == firsttx) {
 				flags |= GEM_TD_START_OF_PACKET;
-				if (++sc->sc_txwin > GEM_NTXSEGS * 2 / 3) {
-					sc->sc_txwin = 0;
-					flags |= GEM_TD_INTERRUPT_ME;
-				}
-
 #ifdef INET
 				/* h/w checksum */
 				if (ifp->if_csum_flags_tx & M_CSUM_TCPv4 &&
@@ -1526,8 +1520,10 @@ gem_start(struct ifnet *ifp)
 						break;
 					default:
 						/* unsupported, drop it */
-						m_free(m0);
-						continue;
+						bus_dmamap_unload(sc->sc_dmatag,
+							dmamap);
+						m_freem(m0);
+						goto next;
 					}
 					start += M_CSUM_DATA_IPv4_IPHL(m0->m_pkthdr.csum_data);
 					offset = M_CSUM_DATA_IPv4_OFFSET(m0->m_pkthdr.csum_data) + start;
@@ -1538,7 +1534,13 @@ gem_start(struct ifnet *ifp)
 						 GEM_TD_CXSUM_ENABLE;
 				}
 #endif
+				if (++sc->sc_txwin > GEM_NTXSEGS * 2 / 3) {
+					sc->sc_txwin = 0;
+					flags |= GEM_TD_INTERRUPT_ME;
+				}
 			}
+			sc->sc_txdescs[nexttx].gd_addr =
+			    GEM_DMA_WRITE(sc, dmamap->dm_segs[seg].ds_addr);
 			if (seg == dmamap->dm_nsegs - 1) {
 				flags |= GEM_TD_END_OF_PACKET;
 			} else {