From 12769291ed3c13c95fe1fedde5c8dfd017aa31ca Mon Sep 17 00:00:00 2001 From: hselasky Date: Fri, 23 Sep 2016 08:35:56 +0000 Subject: [PATCH] MFC r305877: mlx5en: Fix duplicate mbuf free-by-code. When mlx5e_sq_xmit() returns an error code and the mbuf pointer is set, we should not free the mbuf, because the caller will keep the mbuf in the drbr. Make sure the mbuf pointer is correctly set upon function exit. Sponsored by: Mellanox Technologies git-svn-id: svn://svn.freebsd.org/base/stable/10@306254 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f --- sys/dev/mlx5/mlx5_en/mlx5_en_tx.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/sys/dev/mlx5/mlx5_en/mlx5_en_tx.c b/sys/dev/mlx5/mlx5_en/mlx5_en_tx.c index f83b11eee..eae3d728d 100644 --- a/sys/dev/mlx5/mlx5_en/mlx5_en_tx.c +++ b/sys/dev/mlx5/mlx5_en/mlx5_en_tx.c @@ -224,10 +224,8 @@ mlx5e_sq_xmit(struct mlx5e_sq *sq, struct mbuf **mbp) /* Send one multi NOP message instead of many */ mlx5e_send_nop(sq, (pi + 1) * MLX5_SEND_WQEBB_NUM_DS); pi = ((~sq->pc) & sq->wq.sz_m1); - if (pi < (MLX5_SEND_WQE_MAX_WQEBBS - 1)) { - m_freem(mb); + if (pi < (MLX5_SEND_WQE_MAX_WQEBBS - 1)) return (ENOMEM); - } } /* Setup local variables */ @@ -338,10 +336,8 @@ mlx5e_sq_xmit(struct mlx5e_sq *sq, struct mbuf **mbp) mb, segs, &nsegs, BUS_DMA_NOWAIT); } /* Catch errors */ - if (err != 0) { + if (err != 0) goto tx_drop; - } - *mbp = mb; for (x = 0; x != nsegs; x++) { if (segs[x].ds_len == 0) @@ -374,6 +370,7 @@ mlx5e_sq_xmit(struct mlx5e_sq *sq, struct mbuf **mbp) bus_dmamap_sync(sq->dma_tag, sq->mbuf[pi].dma_map, BUS_DMASYNC_PREWRITE); sq->stats.packets++; + *mbp = NULL; /* safety clear */ return (0); tx_drop: -- 2.45.0