[src/netbsd-6]: src/sys/dev/pci Pull up following revision(s) (requested by m...

[snj <snj%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/7a9371f56822
branches:  netbsd-6
changeset: 777211:7a9371f56822
user:      snj <snj%NetBSD.org@localhost>
date:      Fri Aug 18 14:58:15 2017 +0000

description:
Pull up following revision(s) (requested by mrg in ticket #1473):
        sys/dev/pci/if_ipw.c: revision 1.65 via patch
Null out sbuf->m on failure to avoid double-free later.
>From Ilja Van Sprundel.
Also null out sbuf->map out of paranoia.

diffstat:

 sys/dev/pci/if_ipw.c |  8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diffs (44 lines):

diff -r 8d2bbc8c2068 -r 7a9371f56822 sys/dev/pci/if_ipw.c
--- a/sys/dev/pci/if_ipw.c      Fri Aug 18 14:53:10 2017 +0000
+++ b/sys/dev/pci/if_ipw.c      Fri Aug 18 14:58:15 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_ipw.c,v 1.53 2012/01/30 19:41:20 drochner Exp $     */
+/*     $NetBSD: if_ipw.c,v 1.53.2.1 2017/08/18 14:58:15 snj Exp $      */
 /*     FreeBSD: src/sys/dev/ipw/if_ipw.c,v 1.15 2005/11/13 17:17:40 damien Exp         */
 
 /*-
@@ -29,7 +29,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_ipw.c,v 1.53 2012/01/30 19:41:20 drochner Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_ipw.c,v 1.53.2.1 2017/08/18 14:58:15 snj Exp $");
 
 /*-
  * Intel(R) PRO/Wireless 2100 MiniPCI driver
@@ -590,6 +590,7 @@
                MCLGET(sbuf->m, M_DONTWAIT);
                if (!(sbuf->m->m_flags & M_EXT)) {
                        m_freem(sbuf->m);
+                       sbuf->m = NULL;
                        aprint_error_dev(&sc->sc_dev, "could not allocate rx mbuf cluster\n");
                        error = ENOMEM;
                        goto fail;
@@ -602,6 +603,7 @@
                if (error != 0) {
                        aprint_error_dev(&sc->sc_dev, "could not create rxbuf dma map\n");
                        m_freem(sbuf->m);
+                       sbuf->m = NULL;
                        goto fail;
                }
 
@@ -609,7 +611,9 @@
                    sbuf->m, BUS_DMA_READ | BUS_DMA_NOWAIT);
                if (error != 0) {
                        bus_dmamap_destroy(sc->sc_dmat, sbuf->map);
+                       sbuf->map = NULL;
                        m_freem(sbuf->m);
+                       sbuf->m = NULL;
                        aprint_error_dev(&sc->sc_dev, "could not map rxbuf dma memory\n");
                        goto fail;
                }