There's no nede to allocate a DMA map just before calling bus_dmamem_alloc().

In fact, bus_dmamem_alloc() happily NULLs the dmat pointer passed in,
before replacing it with its own.

This fixes a MIPS crash when kldload'ing if_ath/if_ath_pci -
bus_dmamap_destroy() was passed in a NULL dmat pointer and was doing
all kinds of very bad things.

Reviewed by:	scottl
This commit is contained in:
Adrian Chadd 2012-08-29 16:58:51 +00:00
parent bf38cf8ab3
commit fb20fd244e

View file

@ -2856,13 +2856,6 @@ ath_descdma_alloc_desc(struct ath_softc *sc,
}
/* allocate descriptors */
error = bus_dmamap_create(dd->dd_dmat, BUS_DMA_NOWAIT, &dd->dd_dmamap);
if (error != 0) {
if_printf(ifp, "unable to create dmamap for %s descriptors, "
"error %u\n", dd->dd_name, error);
goto fail0;
}
error = bus_dmamem_alloc(dd->dd_dmat, (void**) &dd->dd_desc,
BUS_DMA_NOWAIT | BUS_DMA_COHERENT,
&dd->dd_dmamap);
@ -2892,8 +2885,6 @@ ath_descdma_alloc_desc(struct ath_softc *sc,
fail2:
bus_dmamem_free(dd->dd_dmat, dd->dd_desc, dd->dd_dmamap);
fail1:
bus_dmamap_destroy(dd->dd_dmat, dd->dd_dmamap);
fail0:
bus_dma_tag_destroy(dd->dd_dmat);
memset(dd, 0, sizeof(*dd));
return error;
@ -2976,7 +2967,6 @@ ath_descdma_setup(struct ath_softc *sc,
fail3:
bus_dmamap_unload(dd->dd_dmat, dd->dd_dmamap);
bus_dmamem_free(dd->dd_dmat, dd->dd_desc, dd->dd_dmamap);
bus_dmamap_destroy(dd->dd_dmat, dd->dd_dmamap);
bus_dma_tag_destroy(dd->dd_dmat);
memset(dd, 0, sizeof(*dd));
return error;
@ -3057,7 +3047,6 @@ ath_descdma_cleanup(struct ath_softc *sc,
if (dd->dd_dmamap != 0) {
bus_dmamap_unload(dd->dd_dmat, dd->dd_dmamap);
bus_dmamem_free(dd->dd_dmat, dd->dd_desc, dd->dd_dmamap);
bus_dmamap_destroy(dd->dd_dmat, dd->dd_dmamap);
bus_dma_tag_destroy(dd->dd_dmat);
}