upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-05-28 04:12:45 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

MFC 198814.

Browse source 
Add a check to know whether driver is still running after
  reacquiring driver lock in Rx handler. re(4) drops a driver lock
  before passing received frame to upper stack and reacquire the
  lock. During the time window ioctl calls could be executed and if
  the ioctl was interface down request, driver will stop the
  controller and free allocated mbufs. After that when driver comes
  back to Rx handler again it does not know what was happend so it
  could access free mbufs which in turn cause panic.

  Reported by:	Norbert Papke < npapk <> acm dot org >
  Tested by:	Norbert Papke < npapk <> acm dot org >
This commit is contained in:
Pyun YongHyeon 2009-11-29 19:49:21 +00:00
parent cb08d589eb
commit 2ff1d99219
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
sys/dev/re/if_re.c
View file

@ -1817,6 +1817,8 @@ re_rxeof(struct rl_softc *sc, int *rx_npktsp)
for (i = sc->rl_ldata.rl_rx_prodidx; maxpkt > 0;
i = RL_RX_DESC_NXT(sc, i)) {
if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
break;
cur_rx = &sc->rl_ldata.rl_rx_list[i];
rxstat = le32toh(cur_rx->rl_cmdstat);
if ((rxstat & RL_RDESC_STAT_OWN) != 0)