Undo m_defrag().

m_defrag() does not work.  It seems to assume that if the length of
the mbuf passed as parameter is less than MHLEN, then it is an mbuf
header and not a cluster (or something like that.)
It thus fails miserably in the bcopy path.
I don't have the time to investigate further into this.

Thanks to Okan Demirmen for reporting the issue on a ral(4) RT2560.
The RT2560 chipset does not support TX scatter and thus m_defrag()
was called much more often than in other drivers using m_defrag()
where it was less noticeable.

1 files changed, 18 insertions, 3 deletions

diff --git a/sys/dev/ic/rt2661.c b/sys/dev/ic/rt2661.c
index c22fd40b010..b146edefd82 100644
--- a/sys/dev/ic/rt2661.c
+++ b/sys/dev/ic/rt2661.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rt2661.c,v 1.45 2008/11/25 21:43:57 damien Exp $	*/
+/*	$OpenBSD: rt2661.c,v 1.46 2008/12/21 18:19:58 damien Exp $	*/
 
 /*-
  * Copyright (c) 2006
@@ -1546,6 +1546,7 @@ rt2661_tx_data(struct rt2661_softc *sc, struct mbuf *m0,
 	struct rt2661_tx_data *data;
 	struct ieee80211_frame *wh;
 	struct ieee80211_key *k;
+	struct mbuf *m1;
 	uint16_t dur;
 	uint32_t flags = 0;
 	int pktlen, rate, needcts = 0, needrts = 0, error;
@@ -1671,10 +1672,24 @@ rt2661_tx_data(struct rt2661_softc *sc, struct mbuf *m0,
 	}
 	if (error != 0) {
 		/* too many fragments, linearize */
-		if (m_defrag(m0, M_DONTWAIT) != 0) {
+		MGETHDR(m1, MT_DATA, M_DONTWAIT);
+		if (m1 == NULL) {
 			m_freem(m0);
-			return ENOMEM;
+			return ENOBUFS;
+		}
+		if (m0->m_pkthdr.len > MHLEN) {
+			MCLGET(m1, M_DONTWAIT);
+			if (!(m1->m_flags & M_EXT)) {
+				m_freem(m0);
+				m_freem(m1);
+				return ENOBUFS;
+			}
 		}
+		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m1, caddr_t));
+		m1->m_pkthdr.len = m1->m_len = m0->m_pkthdr.len;
+		m_freem(m0);
+		m0 = m1;
+
 		error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
 		    BUS_DMA_NOWAIT);
 		if (error != 0) {