vmx(4) driver causes kernel panic

[Takehiko NOZAKI]

vmx(4) driver w/i386 kernel causes kernel panic on cvs update(maybe double m_freem() bug).

NetBSD-current has same problem.

[Takehiko NOZAKI]

the bug was introduced due to careless about m_defrag's prototype difference between OpenBSD and NetBSD.

• OpenBSD -- int m_defrag(struct mbuf *, int)
• NetBSD -- struct mbuf m_defrag(struct mbuf , int)

so, following code doesn't work as the author expected, and causes double free mbuf bug.

    case EFBIG:
        if (m_defrag(m, M_DONTWAIT) == 0 &&
            bus_dmamap_load_mbuf(sc->sc_dmat, map, m,
             BUS_DMA_NOWAIT) == 0)
            break;

        /* FALLTHROUGH */
    default:
        m_freem(m);
        return -1;
    }

analyzed by me and tsutsui@, thanks.

[Takehiko NOZAKI]

BUGFIX: Issue #1 -- vmx(4) driver causes kernel panic.

→ <<cset b30f6b027612>>