On Tue, Jun 17, 2008 at 05:07:10AM +0200, Quentin Garnier wrote: > It's a rather easy fix, I'll have a try at it later, unless someone > beats me to it. All other mbuf external storage allocators should be > audited, they're likely to suffer from the same issue as well. Try the attached patch. Beware, not even test-compiled :) -- Quentin Garnier - cube%cubidou.net@localhost - cube%NetBSD.org@localhost "See the look on my face from staying too long in one place [...] every time the morning breaks I know I'm closer to falling" KT Tunstall, Saving My Face, Drastic Fantastic, 2007.
Index: if_sk.c
===================================================================
RCS file: /cvsroot/src/sys/dev/pci/if_sk.c,v
retrieving revision 1.49
diff -u -r1.49 if_sk.c
--- if_sk.c 28 Apr 2008 20:23:55 -0000 1.49
+++ if_sk.c 17 Jun 2008 03:27:30 -0000
@@ -125,6 +125,7 @@
#include <sys/sockio.h>
#include <sys/mbuf.h>
#include <sys/malloc.h>
+#include <sys/mutex.h>
#include <sys/kernel.h>
#include <sys/socket.h>
#include <sys/device.h>
@@ -858,6 +859,7 @@
LIST_INIT(&sc_if->sk_jfree_listhead);
LIST_INIT(&sc_if->sk_jinuse_listhead);
+ mutex_init(&sc_if->sk_jpool_mtx, MUTEX_SPIN, IPL_NET);
/*
* Now divide it up into 9K pieces and save the addresses
@@ -912,13 +914,17 @@
{
struct sk_jpool_entry *entry;
+ mutex_enter(&sc_if->sk_jpool_mtx);
entry = LIST_FIRST(&sc_if->sk_jfree_listhead);
- if (entry == NULL)
+ if (entry == NULL) {
+ mutex_leave(&sc_if->sc_jpool_mtx);
return NULL;
+ }
LIST_REMOVE(entry, jpool_entries);
LIST_INSERT_HEAD(&sc_if->sk_jinuse_listhead, entry, jpool_entries);
+ mutex_leave(&sc_if->sc_jpool_mtx);
return sc_if->sk_cdata.sk_jslots[entry->slot];
}
@@ -930,7 +936,7 @@
{
struct sk_jpool_entry *entry;
struct sk_if_softc *sc;
- int i, s;
+ int i;
/* Extract the softc struct pointer. */
sc = (struct sk_if_softc *)arg;
@@ -946,17 +952,17 @@
if ((i < 0) || (i >= SK_JSLOTS))
panic("sk_jfree: asked to free buffer that we don't manage!");
- s = splvm();
+ mutex_enter(&sc_if->sk_jpool_mtx);
entry = LIST_FIRST(&sc->sk_jinuse_listhead);
if (entry == NULL)
panic("sk_jfree: buffer not in use!");
entry->slot = i;
LIST_REMOVE(entry, jpool_entries);
LIST_INSERT_HEAD(&sc->sk_jfree_listhead, entry, jpool_entries);
+ mutex_leave(&sc_if->sc_jpool_mtx);
if (__predict_true(m != NULL))
pool_cache_put(mb_cache, m);
- splx(s);
}
/*
Index: if_skvar.h
===================================================================
RCS file: /cvsroot/src/sys/dev/pci/if_skvar.h,v
retrieving revision 1.13
diff -u -r1.13 if_skvar.h
--- if_skvar.h 28 Apr 2008 20:23:55 -0000 1.13
+++ if_skvar.h 17 Jun 2008 03:27:30 -0000
@@ -232,6 +232,7 @@
struct sk_softc *sk_softc; /* parent controller */
int sk_tx_bmu; /* TX BMU register */
int sk_if_flags;
+ kmutex_t sk_jpool_mtx;
LIST_HEAD(__sk_jfreehead, sk_jpool_entry) sk_jfree_listhead;
LIST_HEAD(__sk_jinusehead, sk_jpool_entry) sk_jinuse_listhead;
SIMPLEQ_HEAD(__sk_txmaphead, sk_txmap_entry) sk_txmap_head;
Attachment:
pgpu4WUIGpM9h.pgp
Description: PGP signature