Releasing TX/RX descriptor dmamaps during device detachment instead of

doing that in bfe_stop().

This should fix a panic recently reported on -current occuring when taking
device down then up.  In the original implementation, an "ifconfig bfe0 down"
triggers bfe_stop(), which also destroys all TX/RX descriptor dmamaps. Hence
the subsequent "ifconfig bfe0 up" would force the device to use those
already-released dmamap and thus panic the kernel.

PR:		kern/77804
Submitted by:	Frank Mayhar <frank at exit dot com>
Reviewed by:	dmlb, sam (mentor)
Tested by:	Phil <pcasidy at casidy dot com>, myself
MFC after:	1 week

1 files changed, 4 insertions, 5 deletions

diff --git a/sys/dev/bfe/if_bfe.c b/sys/dev/bfe/if_bfe.c
index ad5ef06..1f3cc7f 100644
--- a/sys/dev/bfe/if_bfe.c
+++ b/sys/dev/bfe/if_bfe.c
@@ -541,8 +541,6 @@ bfe_tx_ring_free(struct bfe_softc *sc)
 			sc->bfe_tx_ring[i].bfe_mbuf = NULL;
 			bus_dmamap_unload(sc->bfe_tag,
 					sc->bfe_tx_ring[i].bfe_map);
-			bus_dmamap_destroy(sc->bfe_tag,
-					sc->bfe_tx_ring[i].bfe_map);
 		}
 	}
 	bzero(sc->bfe_tx_list, BFE_TX_LIST_SIZE);
@@ -560,15 +558,12 @@ bfe_rx_ring_free(struct bfe_softc *sc)
 			sc->bfe_rx_ring[i].bfe_mbuf = NULL;
 			bus_dmamap_unload(sc->bfe_tag,
 					sc->bfe_rx_ring[i].bfe_map);
-			bus_dmamap_destroy(sc->bfe_tag,
-					sc->bfe_rx_ring[i].bfe_map);
 		}
 	}
 	bzero(sc->bfe_rx_list, BFE_RX_LIST_SIZE);
 	bus_dmamap_sync(sc->bfe_rx_tag, sc->bfe_rx_map, BUS_DMASYNC_PREREAD);
 }
 
-
 static int
 bfe_list_rx_init(struct bfe_softc *sc)
 {
@@ -976,6 +971,10 @@ bfe_release_resources(struct bfe_softc *sc)
 			bus_dmamap_destroy(sc->bfe_tag,
 			    sc->bfe_tx_ring[i].bfe_map);
 		}
+		for(i = 0; i < BFE_RX_LIST_CNT; i++) {
+			bus_dmamap_destroy(sc->bfe_tag,
+			    sc->bfe_rx_ring[i].bfe_map);
+		}
 		bus_dma_tag_destroy(sc->bfe_tag);
 		sc->bfe_tag = NULL;
 	}