Correct some dma cleanup error paths.

While the index variables were correct the arrays of
dma handles they indexed were swapped for rx and tx.

As there are a mismatched number of rx and tx descriptors
we'd walk off the end of the rx handle array by 30 items.

ok deraadt@

diff --git a/sys/arch/vax/if/if_qe.c b/sys/arch/vax/if/if_qe.c
index b413c2e..3af9c49 100644 (file)
--- a/sys/arch/vax/if/if_qe.c
+++ b/sys/arch/vax/if/if_qe.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: if_qe.c,v 1.27 2014/07/12 18:44:43 tedu Exp $ */
+/*     $OpenBSD: if_qe.c,v 1.28 2014/08/06 15:40:40 jsg Exp $  */
 /*      $NetBSD: if_qe.c,v 1.51 2002/06/08 12:28:37 ragge Exp $ */
 /*
  * Copyright (c) 1999 Ludd, University of Lule}, Sweden. All rights reserved.
@@ -345,13 +345,13 @@ qeattach(struct device *parent, struct device *self, void *aux)
        }
  fail_5:
        for (i = 0; i < RXDESCS; i++) {
-               if (sc->sc_xmtmap[i] != NULL)
-                       bus_dmamap_destroy(sc->sc_dmat, sc->sc_xmtmap[i]);
+               if (sc->sc_rcvmap[i] != NULL)
+                       bus_dmamap_destroy(sc->sc_dmat, sc->sc_rcvmap[i]);
        }
  fail_4:
        for (i = 0; i < TXDESCS; i++) {
-               if (sc->sc_rcvmap[i] != NULL)
-                       bus_dmamap_destroy(sc->sc_dmat, sc->sc_rcvmap[i]);
+               if (sc->sc_xmtmap[i] != NULL)
+                       bus_dmamap_destroy(sc->sc_dmat, sc->sc_xmtmap[i]);
        }
 }
 

diff --git a/sys/arch/vax/if/sgec.c b/sys/arch/vax/if/sgec.c
index d0c2cb9..db7e580 100644 (file)
--- a/sys/arch/vax/if/sgec.c
+++ b/sys/arch/vax/if/sgec.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: sgec.c,v 1.22 2014/06/13 21:06:24 miod Exp $  */
+/*     $OpenBSD: sgec.c,v 1.23 2014/08/06 15:40:40 jsg Exp $   */
 /*      $NetBSD: sgec.c,v 1.5 2000/06/04 02:14:14 matt Exp $ */
 /*
  * Copyright (c) 1999 Ludd, University of Lule}, Sweden. All rights reserved.
@@ -240,13 +240,13 @@ sgec_attach(sc)
        }
  fail_5:
        for (i = 0; i < RXDESCS; i++) {
-               if (sc->sc_xmtmap[i] != NULL)
-                       bus_dmamap_destroy(sc->sc_dmat, sc->sc_xmtmap[i]);
+               if (sc->sc_rcvmap[i] != NULL)
+                       bus_dmamap_destroy(sc->sc_dmat, sc->sc_rcvmap[i]);
        }
  fail_4:
        for (i = 0; i < TXDESCS; i++) {
-               if (sc->sc_rcvmap[i] != NULL)
-                       bus_dmamap_destroy(sc->sc_dmat, sc->sc_rcvmap[i]);
+               if (sc->sc_xmtmap[i] != NULL)
+                       bus_dmamap_destroy(sc->sc_dmat, sc->sc_xmtmap[i]);
        }
        bus_dmamap_unload(sc->sc_dmat, sc->sc_cmap);
  fail_3: