diff options
| author | hselasky <hselasky@FreeBSD.org> | 2016-09-23 08:35:56 +0000 |
|---|---|---|
| committer | hselasky <hselasky@FreeBSD.org> | 2016-09-23 08:35:56 +0000 |
| commit | f1424fbcd4898c174307f75dc9cbb9f58fa5293e (patch) | |
| tree | 29c7d9679525706280f95d3310c0f2063e6c84f2 | |
| parent | d86ebdcff67b025a75ca548c866b47db04d8f9f2 (diff) | |
| download | FreeBSD-src-f1424fbcd4898c174307f75dc9cbb9f58fa5293e.zip FreeBSD-src-f1424fbcd4898c174307f75dc9cbb9f58fa5293e.tar.gz | |
MFC r305877:
mlx5en: Fix duplicate mbuf free-by-code.
When mlx5e_sq_xmit() returns an error code and the mbuf pointer is set,
we should not free the mbuf, because the caller will keep the mbuf in
the drbr. Make sure the mbuf pointer is correctly set upon function
exit.
Sponsored by: Mellanox Technologies
| -rw-r--r-- | sys/dev/mlx5/mlx5_en/mlx5_en_tx.c | 9 |
1 files changed, 3 insertions, 6 deletions
diff --git a/sys/dev/mlx5/mlx5_en/mlx5_en_tx.c b/sys/dev/mlx5/mlx5_en/mlx5_en_tx.c index f83b11e..eae3d72 100644 --- a/sys/dev/mlx5/mlx5_en/mlx5_en_tx.c +++ b/sys/dev/mlx5/mlx5_en/mlx5_en_tx.c @@ -224,10 +224,8 @@ mlx5e_sq_xmit(struct mlx5e_sq *sq, struct mbuf **mbp) /* Send one multi NOP message instead of many */ mlx5e_send_nop(sq, (pi + 1) * MLX5_SEND_WQEBB_NUM_DS); pi = ((~sq->pc) & sq->wq.sz_m1); - if (pi < (MLX5_SEND_WQE_MAX_WQEBBS - 1)) { - m_freem(mb); + if (pi < (MLX5_SEND_WQE_MAX_WQEBBS - 1)) return (ENOMEM); - } } /* Setup local variables */ @@ -338,10 +336,8 @@ mlx5e_sq_xmit(struct mlx5e_sq *sq, struct mbuf **mbp) mb, segs, &nsegs, BUS_DMA_NOWAIT); } /* Catch errors */ - if (err != 0) { + if (err != 0) goto tx_drop; - } - *mbp = mb; for (x = 0; x != nsegs; x++) { if (segs[x].ds_len == 0) @@ -374,6 +370,7 @@ skip_dma: bus_dmamap_sync(sq->dma_tag, sq->mbuf[pi].dma_map, BUS_DMASYNC_PREWRITE); sq->stats.packets++; + *mbp = NULL; /* safety clear */ return (0); tx_drop: |
