From 202d6b077cac74141a48d221d3afa61fd189382c Mon Sep 17 00:00:00 2001 From: Stuart Henderson Date: Mon, 11 May 2009 16:23:04 +0000 Subject: in the case where mbufs had to be copied _and_ checksums were enabled, m_head could be accessed after it had been freed, so do the access earlier. from chris@. --- sys/dev/pci/if_vr.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/sys/dev/pci/if_vr.c b/sys/dev/pci/if_vr.c index 8c1d8eee7c8..af4f8cea09e 100644 --- a/sys/dev/pci/if_vr.c +++ b/sys/dev/pci/if_vr.c @@ -1,4 +1,4 @@ -/* $OpenBSD: if_vr.c,v 1.89 2009/05/11 10:25:07 sthen Exp $ */ +/* $OpenBSD: if_vr.c,v 1.90 2009/05/11 16:23:03 sthen Exp $ */ /* * Copyright (c) 1997, 1998 @@ -1145,6 +1145,15 @@ vr_encap(struct vr_softc *sc, struct vr_chain *c, struct mbuf *m_head) struct mbuf *m_new = NULL; u_int32_t vr_flags = 0, vr_status = 0; + if (sc->vr_quirks & VR_Q_CSUM) { + if (m_head->m_pkthdr.csum_flags & M_IPV4_CSUM_OUT) + vr_flags |= VR_TXCTL_IPCSUM; + if (m_head->m_pkthdr.csum_flags & M_TCPV4_CSUM_OUT) + vr_flags |= VR_TXCTL_TCPCSUM; + if (m_head->m_pkthdr.csum_flags & M_UDPV4_CSUM_OUT) + vr_flags |= VR_TXCTL_UDPCSUM; + } + if (sc->vr_quirks & VR_Q_NEEDALIGN || m_head->m_pkthdr.len < VR_MIN_FRAMELEN || bus_dmamap_load_mbuf(sc->sc_dmat, c->vr_map, m_head, @@ -1194,15 +1203,6 @@ vr_encap(struct vr_softc *sc, struct vr_chain *c, struct mbuf *m_head) c->vr_mbuf = m_head; } - if (sc->vr_quirks & VR_Q_CSUM) { - if (m_head->m_pkthdr.csum_flags & M_IPV4_CSUM_OUT) - vr_flags |= VR_TXCTL_IPCSUM; - if (m_head->m_pkthdr.csum_flags & M_TCPV4_CSUM_OUT) - vr_flags |= VR_TXCTL_TCPCSUM; - if (m_head->m_pkthdr.csum_flags & M_UDPV4_CSUM_OUT) - vr_flags |= VR_TXCTL_UDPCSUM; - } - f = c->vr_ptr; f->vr_data = htole32(c->vr_map->dm_segs[0].ds_addr); f->vr_ctl = htole32(c->vr_map->dm_mapsize); -- cgit v1.2.3