svn commit: r260363 - head/sys/dev/ath

[Konstantin Belousov]

On Mon, Jan 06, 2014 at 03:48:32AM +0000, Adrian Chadd wrote:
> Author: adrian
> Date: Mon Jan  6 03:48:32 2014
> New Revision: 260363
> URL: http://svnweb.freebsd.org/changeset/base/260363
> 
> Log:
>   Correctly remove entries from the relevant receive ath_buf list before
>   freeing them.
>   
>   The current code would walk the list and call the buffer free, which
>   didn't remove it from any lists before pushing it back on the free list.
>   
>   Tested:		AR9485, STA mode
>   
>   Noticed by:	dillon at apollo.dragonflybsd.org
This is a NOP, right ?

> 
> Modified:
>   head/sys/dev/ath/if_ath_rx_edma.c
> 
> Modified: head/sys/dev/ath/if_ath_rx_edma.c
> ==============================================================================
> --- head/sys/dev/ath/if_ath_rx_edma.c	Mon Jan  6 01:51:08 2014	(r260362)
> +++ head/sys/dev/ath/if_ath_rx_edma.c	Mon Jan  6 03:48:32 2014	(r260363)
> @@ -450,18 +450,20 @@ ath_edma_recv_proc_queue(struct ath_soft
>  static void
>  ath_edma_flush_deferred_queue(struct ath_softc *sc)
>  {
> -	struct ath_buf *bf, *next;
> +	struct ath_buf *bf;
>  
>  	ATH_RX_LOCK_ASSERT(sc);
>  
>  	/* Free in one set, inside the lock */
> -	TAILQ_FOREACH_SAFE(bf,
> -	    &sc->sc_rx_rxlist[HAL_RX_QUEUE_LP], bf_list, next) {
> +	while (! TAILQ_EMPTY(&sc->sc_rx_rxlist[HAL_RX_QUEUE_LP])) {
> +		bf = TAILQ_FIRST(&sc->sc_rx_rxlist[HAL_RX_QUEUE_LP]);
> +		TAILQ_REMOVE(&sc->sc_rx_rxlist[HAL_RX_QUEUE_LP], bf, bf_list);
>  		/* Free the buffer/mbuf */
>  		ath_edma_rxbuf_free(sc, bf);
>  	}
> -	TAILQ_FOREACH_SAFE(bf,
> -	    &sc->sc_rx_rxlist[HAL_RX_QUEUE_HP], bf_list, next) {
> +	while (! TAILQ_EMPTY(&sc->sc_rx_rxlist[HAL_RX_QUEUE_HP])) {
> +		bf = TAILQ_FIRST(&sc->sc_rx_rxlist[HAL_RX_QUEUE_HP]);
> +		TAILQ_REMOVE(&sc->sc_rx_rxlist[HAL_RX_QUEUE_HP], bf, bf_list);
>  		/* Free the buffer/mbuf */
>  		ath_edma_rxbuf_free(sc, bf);
>  	}
> @@ -495,6 +497,10 @@ ath_edma_recv_proc_deferred_queue(struct
>  	ATH_RX_UNLOCK(sc);
>  
>  	/* Handle the completed descriptors */
> +	/*
> +	 * XXX is this SAFE call needed? The ath_buf entries
> +	 * aren't modified by ath_rx_pkt, right?
> +	 */
>  	TAILQ_FOREACH_SAFE(bf, &rxlist, bf_list, next) {
>  		/*
>  		 * Skip the RX descriptor status - start at the data offset
> @@ -520,7 +526,9 @@ ath_edma_recv_proc_deferred_queue(struct
>  
>  	/* Free in one set, inside the lock */
>  	ATH_RX_LOCK(sc);
> -	TAILQ_FOREACH_SAFE(bf, &rxlist, bf_list, next) {
> +	while (! TAILQ_EMPTY(&rxlist)) {
> +		bf = TAILQ_FIRST(&rxlist);
> +		TAILQ_REMOVE(&rxlist, bf, bf_list);
>  		/* Free the buffer/mbuf */
>  		ath_edma_rxbuf_free(sc, bf);
>  	}
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 834 bytes
Desc: not available
URL: <http://lists.freebsd.org/pipermail/svn-src-all/attachments/20140106/635b60fb/attachment.sig>