Module Name: src Committed By: yamaguchi Date: Tue Dec 1 04:39:03 UTC 2020
Modified Files: src/sys/dev/pci: if_iavf.c Log Message: Dequeue aqb from sc_atq_live even when the last command is failed iavf(4) didn't dequeue aqb from sc_atq_live that is a list for buffer in use when a command is failed by ETIMEDOUT. This causes a panic in the following sequence: 1. enqueue an aqb to sc_atq_live at iavf_aqb_post() 2. the last command is failed by ETIMEDOUT 3. enqueue the aqb used in the failed command to sc_atq_idle at an error handling in iavf_attach() 4. dequeue the same aqb from sc_atq_live and enqueue sc_atq_idle again at iavf_cleanup_admin_queue() - sc_atq_idle is broken at that time 5. free the aqb in sc_atq_idle more than once Fix PR/55822 reviewed by knakahara@n.o. To generate a diff of this commit: cvs rdiff -u -r1.6 -r1.7 src/sys/dev/pci/if_iavf.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.