Author: glebius
Date: Wed Mar 2 02:12:01 2016
New Revision: 296292
URL: https://svnweb.freebsd.org/changeset/base/296292
Log:
Fix regression in r296242 affecting several drivers. For EXT_NET_DRV,
EXT_MOD_TYPE, EXT_DISPOSABLE types we should first execute the free
callback, then free the mbuf, otherwise we will derefernce memory that
was just freed.
Reported and tested: jhibbits
Modified:
head/sys/kern/kern_mbuf.c
Modified: head/sys/kern/kern_mbuf.c
==============================================================================
--- head/sys/kern/kern_mbuf.c Wed Mar 2 01:40:47 2016 (r296291)
+++ head/sys/kern/kern_mbuf.c Wed Mar 2 02:12:01 2016 (r296292)
@@ -677,8 +677,12 @@ mb_free_ext(struct mbuf *m)
case EXT_NET_DRV:
case EXT_MOD_TYPE:
case EXT_DISPOSABLE:
+ KASSERT(m->m_ext.ext_free != NULL,
+ ("%s: ext_free not set", __func__));
+ (*(m->m_ext.ext_free))(m, m->m_ext.ext_arg1,
+ m->m_ext.ext_arg2);
uma_zfree(zone_mbuf, mref);
- /* FALLTHROUGH */
+ break;
case EXT_EXTREF:
KASSERT(m->m_ext.ext_free != NULL,
("%s: ext_free not set", __func__));
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
