Print this page
5976 e1000g use after free on start failure


1438         p_rx_sw_packet_t packet, next_packet;
1439         uint32_t ref_cnt;
1440 
1441         mutex_enter(&e1000g_rx_detach_lock);
1442 
1443         packet = rx_data->packet_area;
1444         while (packet != NULL) {
1445                 next_packet = packet->next;
1446 
1447                 ref_cnt = atomic_dec_32_nv(&packet->ref_cnt);
1448                 if (ref_cnt > 0) {
1449                         atomic_inc_32(&rx_data->pending_count);
1450                         atomic_inc_32(&e1000g_mblks_pending);
1451                 } else {
1452                         e1000g_free_rx_sw_packet(packet, full_release);
1453                 }
1454 
1455                 packet = next_packet;
1456         }
1457 



1458         mutex_exit(&e1000g_rx_detach_lock);
1459 }
1460 
1461 
1462 static void
1463 e1000g_free_tx_packets(e1000g_tx_ring_t *tx_ring)
1464 {
1465         int j;
1466         struct e1000g *Adapter;
1467         p_tx_sw_packet_t packet;
1468         dma_buffer_t *tx_buf;
1469 
1470         Adapter = tx_ring->adapter;
1471 
1472         for (j = 0, packet = tx_ring->packet_area;
1473             j < Adapter->tx_freelist_num; j++, packet++) {
1474 
1475                 if (packet == NULL)
1476                         break;
1477 




1438         p_rx_sw_packet_t packet, next_packet;
1439         uint32_t ref_cnt;
1440 
1441         mutex_enter(&e1000g_rx_detach_lock);
1442 
1443         packet = rx_data->packet_area;
1444         while (packet != NULL) {
1445                 next_packet = packet->next;
1446 
1447                 ref_cnt = atomic_dec_32_nv(&packet->ref_cnt);
1448                 if (ref_cnt > 0) {
1449                         atomic_inc_32(&rx_data->pending_count);
1450                         atomic_inc_32(&e1000g_mblks_pending);
1451                 } else {
1452                         e1000g_free_rx_sw_packet(packet, full_release);
1453                 }
1454 
1455                 packet = next_packet;
1456         }
1457 
1458         if (full_release)
1459                 rx_data->packet_area = NULL;
1460 
1461         mutex_exit(&e1000g_rx_detach_lock);
1462 }
1463 
1464 
1465 static void
1466 e1000g_free_tx_packets(e1000g_tx_ring_t *tx_ring)
1467 {
1468         int j;
1469         struct e1000g *Adapter;
1470         p_tx_sw_packet_t packet;
1471         dma_buffer_t *tx_buf;
1472 
1473         Adapter = tx_ring->adapter;
1474 
1475         for (j = 0, packet = tx_ring->packet_area;
1476             j < Adapter->tx_freelist_num; j++, packet++) {
1477 
1478                 if (packet == NULL)
1479                         break;
1480