>Number:         36945
>Category:       kern
>Synopsis:       Bug in IEEE1394 fwohci_at_output()
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Sep 07 18:50:00 +0000 2007
>Originator:     Ross Philipson
>Release:        3.0.1
>Organization:
>Environment:
NA
>Description:
The bug is down deep in some of the 1394 code and it would only happen (presumably) under low resource conditions. I didn't actually see it happen, just noted it in the code.

Within the 1394 function fwohci_at_output():

// START HERE: this line allocs a new fwohci_buf
fb = malloc(sizeof(*fb), M_DEVBUF, M_WAITOK);
if (ndesc > 2) {
  if ((error = bus_dmamap_create(sc->sc_dmat, pkt->fp_dlen,
       OHCI_DESC_MAX - 2, pkt->fp_dlen, 0, BUS_DMA_WAITOK,
       &fb->fb_dmamap)) != 0) {
    // BAD: no descriptors have been allocated yet! Note second
    // case just below is incorrect too.
    fwohci_desc_put(sc, fb->fb_desc, ndesc);
    free(fb, M_DEVBUF);
    return error;
  }
  // etc.
}
>How-To-Repeat:
NA
>Fix:
Just removed to 2 calls to fwohci_desc_put() where they are not needed.