diff options
| author | yongari <yongari@FreeBSD.org> | 2009-11-02 18:35:05 +0000 |
|---|---|---|
| committer | yongari <yongari@FreeBSD.org> | 2009-11-02 18:35:05 +0000 |
| commit | b503f1efef0b36293cc89d300ddcc25679f1c9bc (patch) | |
| tree | 3cc1f37720349b2a20ba22eb1db928a6a80743c4 /sys/dev/re/if_re.c | |
| parent | 634b156082d6489ae8f8d8e66823c0e621552254 (diff) | |
| download | FreeBSD-src-b503f1efef0b36293cc89d300ddcc25679f1c9bc.zip FreeBSD-src-b503f1efef0b36293cc89d300ddcc25679f1c9bc.tar.gz | |
Add a check to know whether driver is still running after
reacquiring driver lock in Rx handler. re(4) drops a driver lock
before passing received frame to upper stack and reacquire the
lock. During the time window ioctl calls could be executed and if
the ioctl was interface down request, driver will stop the
controller and free allocated mbufs. After that when driver comes
back to Rx handler again it does not know what was happend so it
could access free mbufs which in turn cause panic.
Reported by: Norbert Papke < npapk <> acm dot org >
Tested by: Norbert Papke < npapk <> acm dot org >
Diffstat (limited to 'sys/dev/re/if_re.c')
| -rw-r--r-- | sys/dev/re/if_re.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/sys/dev/re/if_re.c b/sys/dev/re/if_re.c index 5a5790d..25d189b 100644 --- a/sys/dev/re/if_re.c +++ b/sys/dev/re/if_re.c @@ -1817,6 +1817,8 @@ re_rxeof(struct rl_softc *sc, int *rx_npktsp) for (i = sc->rl_ldata.rl_rx_prodidx; maxpkt > 0; i = RL_RX_DESC_NXT(sc, i)) { + if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) + break; cur_rx = &sc->rl_ldata.rl_rx_list[i]; rxstat = le32toh(cur_rx->rl_cmdstat); if ((rxstat & RL_RDESC_STAT_OWN) != 0) |
