The branch stable/13 has been updated by mhorne: URL: https://cgit.FreeBSD.org/src/commit/?id=bdedfb3a0068f08867f47b4ffad98297e5345c94
commit bdedfb3a0068f08867f47b4ffad98297e5345c94 Author: Mitchell Horne <[email protected]> AuthorDate: 2022-06-15 15:53:25 +0000 Commit: Mitchell Horne <[email protected]> CommitDate: 2022-07-04 16:34:57 +0000 if_ffec: free the dmamem allocation in detach Calling bus_dmamap_destroy() for a mapping which was allocated with bus_dmamem_alloc() will result in a panic. This change is not run-time tested, but I identified the issue while implementing the analogous method in if_dwc(4), using this implementation as the template. MFC after: 1 week Sponsored by: The FreeBSD Foundation (cherry picked from commit 8757d0fca9e6a9e174bc87728e296e5338d30eb7) --- sys/dev/ffec/if_ffec.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/sys/dev/ffec/if_ffec.c b/sys/dev/ffec/if_ffec.c index 66e053fcdf67..090869abeba1 100644 --- a/sys/dev/ffec/if_ffec.c +++ b/sys/dev/ffec/if_ffec.c @@ -1425,7 +1425,8 @@ ffec_detach(device_t dev) bus_dma_tag_destroy(sc->rxbuf_tag); if (sc->rxdesc_map != NULL) { bus_dmamap_unload(sc->rxdesc_tag, sc->rxdesc_map); - bus_dmamap_destroy(sc->rxdesc_tag, sc->rxdesc_map); + bus_dmamem_free(sc->rxdesc_tag, sc->rxdesc_ring, + sc->rxdesc_map); } if (sc->rxdesc_tag != NULL) bus_dma_tag_destroy(sc->rxdesc_tag); @@ -1441,7 +1442,8 @@ ffec_detach(device_t dev) bus_dma_tag_destroy(sc->txbuf_tag); if (sc->txdesc_map != NULL) { bus_dmamap_unload(sc->txdesc_tag, sc->txdesc_map); - bus_dmamap_destroy(sc->txdesc_tag, sc->txdesc_map); + bus_dmamem_free(sc->txdesc_tag, sc->txdesc_ring, + sc->txdesc_map); } if (sc->txdesc_tag != NULL) bus_dma_tag_destroy(sc->txdesc_tag);
