diff options
| author | Stuart Henderson <sthen@cvs.openbsd.org> | 2009-05-11 16:23:04 +0000 |
|---|---|---|
| committer | Stuart Henderson <sthen@cvs.openbsd.org> | 2009-05-11 16:23:04 +0000 |
| commit | 202d6b077cac74141a48d221d3afa61fd189382c (patch) | |
| tree | 7c853ed36538da263f7ef8189fa207603813de61 /sys/dev/pci/if_vr.c | |
| parent | c66d2d2807882881b556c00e3ac84d6ac24a0dcc (diff) | |
in the case where mbufs had to be copied _and_ checksums were enabled,
m_head could be accessed after it had been freed, so do the access earlier.
from chris@.
Diffstat (limited to 'sys/dev/pci/if_vr.c')
| -rw-r--r-- | sys/dev/pci/if_vr.c | 20 |
1 files changed, 10 insertions, 10 deletions
diff --git a/sys/dev/pci/if_vr.c b/sys/dev/pci/if_vr.c index 8c1d8eee7c8..af4f8cea09e 100644 --- a/sys/dev/pci/if_vr.c +++ b/sys/dev/pci/if_vr.c @@ -1,4 +1,4 @@ -/* $OpenBSD: if_vr.c,v 1.89 2009/05/11 10:25:07 sthen Exp $ */ +/* $OpenBSD: if_vr.c,v 1.90 2009/05/11 16:23:03 sthen Exp $ */ /* * Copyright (c) 1997, 1998 @@ -1145,6 +1145,15 @@ vr_encap(struct vr_softc *sc, struct vr_chain *c, struct mbuf *m_head) struct mbuf *m_new = NULL; u_int32_t vr_flags = 0, vr_status = 0; + if (sc->vr_quirks & VR_Q_CSUM) { + if (m_head->m_pkthdr.csum_flags & M_IPV4_CSUM_OUT) + vr_flags |= VR_TXCTL_IPCSUM; + if (m_head->m_pkthdr.csum_flags & M_TCPV4_CSUM_OUT) + vr_flags |= VR_TXCTL_TCPCSUM; + if (m_head->m_pkthdr.csum_flags & M_UDPV4_CSUM_OUT) + vr_flags |= VR_TXCTL_UDPCSUM; + } + if (sc->vr_quirks & VR_Q_NEEDALIGN || m_head->m_pkthdr.len < VR_MIN_FRAMELEN || bus_dmamap_load_mbuf(sc->sc_dmat, c->vr_map, m_head, @@ -1194,15 +1203,6 @@ vr_encap(struct vr_softc *sc, struct vr_chain *c, struct mbuf *m_head) c->vr_mbuf = m_head; } - if (sc->vr_quirks & VR_Q_CSUM) { - if (m_head->m_pkthdr.csum_flags & M_IPV4_CSUM_OUT) - vr_flags |= VR_TXCTL_IPCSUM; - if (m_head->m_pkthdr.csum_flags & M_TCPV4_CSUM_OUT) - vr_flags |= VR_TXCTL_TCPCSUM; - if (m_head->m_pkthdr.csum_flags & M_UDPV4_CSUM_OUT) - vr_flags |= VR_TXCTL_UDPCSUM; - } - f = c->vr_ptr; f->vr_data = htole32(c->vr_map->dm_segs[0].ds_addr); f->vr_ctl = htole32(c->vr_map->dm_mapsize); |