[src/netbsd-9]: src/sys/dev/ic Pull up following revision(s) (requested by ms...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/5ced041db1f2
branches:  netbsd-9
changeset: 466979:5ced041db1f2
user:      martin <martin%NetBSD.org@localhost>
date:      Wed Jan 08 11:50:57 2020 +0000

description:
Pull up following revision(s) (requested by msaitoh in ticket #610):

        sys/dev/ic/gem.c: revision 1.124

Fix error path in gem(4)'s TX checksum offload.

 - Avoid accessing free'd m0 on error. Use m_freem() instead of m_free().
   Reported by maxv@.
 - Tested by martin@, macallan@ and jdc@.

diffstat:

 sys/dev/ic/gem.c |  24 +++++++++++++-----------
 1 files changed, 13 insertions(+), 11 deletions(-)

diffs (70 lines):

diff -r 5191b20d2d2e -r 5ced041db1f2 sys/dev/ic/gem.c
--- a/sys/dev/ic/gem.c  Wed Jan 08 07:58:48 2020 +0000
+++ b/sys/dev/ic/gem.c  Wed Jan 08 11:50:57 2020 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: gem.c,v 1.120 2019/05/28 08:59:34 msaitoh Exp $ */
+/*     $NetBSD: gem.c,v 1.120.2.1 2020/01/08 11:50:57 martin Exp $ */
 
 /*
  *
@@ -37,7 +37,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: gem.c,v 1.120 2019/05/28 08:59:34 msaitoh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: gem.c,v 1.120.2.1 2020/01/08 11:50:57 martin Exp $");
 
 #include "opt_inet.h"
 
@@ -1389,6 +1389,7 @@
         * until we drain the queue, or use up all available transmit
         * descriptors.
         */
+next:
        while ((txs = SIMPLEQ_FIRST(&sc->sc_txfreeq)) != NULL &&
            sc->sc_txfree != 0) {
                /*
@@ -1498,16 +1499,9 @@
                         * and the checksum stuff if we want the hardware
                         * to do it.
                         */
-                       sc->sc_txdescs[nexttx].gd_addr =
-                           GEM_DMA_WRITE(sc, dmamap->dm_segs[seg].ds_addr);
                        flags = dmamap->dm_segs[seg].ds_len & GEM_TD_BUFSIZE;
                        if (nexttx == firsttx) {
                                flags |= GEM_TD_START_OF_PACKET;
-                               if (++sc->sc_txwin > GEM_NTXSEGS * 2 / 3) {
-                                       sc->sc_txwin = 0;
-                                       flags |= GEM_TD_INTERRUPT_ME;
-                               }
-
 #ifdef INET
                                /* h/w checksum */
                                if (ifp->if_csum_flags_tx & M_CSUM_TCPv4 &&
@@ -1526,8 +1520,10 @@
                                                break;
                                        default:
                                                /* unsupported, drop it */
-                                               m_free(m0);
-                                               continue;
+                                               bus_dmamap_unload(sc->sc_dmatag,
+                                                       dmamap);
+                                               m_freem(m0);
+                                               goto next;
                                        }
                                        start += M_CSUM_DATA_IPv4_IPHL(m0->m_pkthdr.csum_data);
                                        offset = M_CSUM_DATA_IPv4_OFFSET(m0->m_pkthdr.csum_data) + start;
@@ -1538,7 +1534,13 @@
                                                 GEM_TD_CXSUM_ENABLE;
                                }
 #endif
+                               if (++sc->sc_txwin > GEM_NTXSEGS * 2 / 3) {
+                                       sc->sc_txwin = 0;
+                                       flags |= GEM_TD_INTERRUPT_ME;
+                               }
                        }
+                       sc->sc_txdescs[nexttx].gd_addr =
+                           GEM_DMA_WRITE(sc, dmamap->dm_segs[seg].ds_addr);
                        if (seg == dmamap->dm_nsegs - 1) {
                                flags |= GEM_TD_END_OF_PACKET;
                        } else {