Lock down the network interface queues. The queue mutex must be obtained

before adding/removing packets from the queue.  Also, the if_obytes and
if_omcasts fields should only be manipulated under protection of the mutex.

IF_ENQUEUE, IF_PREPEND, and IF_DEQUEUE perform all necessary locking on
the queue.  An IF_LOCK macro is provided, as well as the old (mutex-less)
versions of the macros in the form _IF_ENQUEUE, _IF_QFULL, for code which
needs them, but their use is discouraged.

Two new macros are introduced: IF_DRAIN() to drain a queue, and IF_HANDOFF,
which takes care of locking/enqueue, and also statistics updating/start
if necessary.

1 files changed, 10 insertions, 13 deletions

diff --git a/sys/dev/usb/udbp.c b/sys/dev/usb/udbp.c
index 71eb710..d75e1f2 100644
--- a/sys/dev/usb/udbp.c
+++ b/sys/dev/usb/udbp.c
@@ -359,6 +359,8 @@ USB_ATTACH(udbp)
 		sc->node->private = sc;
 		sc->xmitq.ifq_maxlen = IFQ_MAXLEN;
 		sc->xmitq_hipri.ifq_maxlen = IFQ_MAXLEN;
+		mtx_init(&sc->xmitq.ifq_mtx, "usb_xmitq", MTX_DEF);
+		mtx_init(&sc->xmitq_hipri.ifq_mtx, "usb_xmitq_hipri", MTX_DEF);
 		sprintf(nodename, "%s", USBDEVNAME(sc->sc_dev));
 		if ((err = ng_name_node(sc->node, nodename))) {
 			ng_rmnode(sc->node);
@@ -737,13 +739,16 @@ ng_udbp_rcvdata(hook_p hook, struct mbuf *m, meta_p meta,
 		xmitq_p = (&sc->xmitq);
 	}
 	s = splusb();
-	if (IF_QFULL(xmitq_p)) {
-		IF_DROP(xmitq_p);
+	IF_LOCK(xmitq_p);
+	if (_IF_QFULL(xmitq_p)) {
+		_IF_DROP(xmitq_p);
+		IF_UNLOCK(xmitq_p);
 		splx(s);
 		error = ENOBUFS;
 		goto bad;
 	}
-	IF_ENQUEUE(xmitq_p, m);
+	_IF_ENQUEUE(xmitq_p, m);
+	IF_UNLOCK(xmitq_p);
 	if (!(sc->flags & OUT_BUSY))
 		udbp_setup_out_transfer(sc);
 	splx(s);
@@ -772,16 +777,8 @@ ng_udbp_rmnode(node_p node)
 	ng_cutlinks(node);
 
 	/* Drain the queues */
-	do {
-		IF_DEQUEUE(&sc->xmitq_hipri, m);
-		if (m)
-			m_freem(m);
-	} while (m);
-	do {
-		IF_DEQUEUE(&sc->xmitq, m);
-		if (m)
-			m_freem(m);
-	} while (m);
+	IF_DRAIN(&sc->xmitq_hipri);
+	IF_DRAIN(&sc->xmitq);
 
 	sc->packets_in = 0;		/* reset stats */
 	sc->packets_out = 0;