d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

iflib: netmap: fix rsync index overrun

Browse Source 
In the current iflib_netmap_rxsync, there is nothing that prevents
kring->nr_hwtail to overrun kring->nr_hwcur during the descriptor
import phase. This may cause errors in netmap applications, such as:

em1 RX0: fail 'head < kring->nr_hwcur || head > kring->nr_hwtail'
    h 795 c 795 t 282 rh 795 rc 795 rt 282 hc 282 ht 282

Reviewed by:	gallatin
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D25252
This commit is contained in:
Vincenzo Maffione 2020-06-23 20:23:56 +00:00
parent 4d56980017
commit 0ff2126795
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sys/net/iflib.c
View File

@ -1099,6 +1099,7 @@ iflib_netmap_rxsync(struct netmap_kring *kring, int flags)
* rxr->next_check is set to 0 on a ring reinit
*/
if (netmap_no_pendintr || force_update) {
uint32_t hwtail_lim = nm_prev(kring->nr_hwcur, lim);
int crclen = iflib_crcstrip ? 0 : 4;
int error, avail;
@ -1108,7 +1109,7 @@ iflib_netmap_rxsync(struct netmap_kring *kring, int flags)
nm_i = netmap_idx_n2k(kring, nic_i);
avail = ctx->isc_rxd_available(ctx->ifc_softc,
rxq->ifr_id, nic_i, USHRT_MAX);
for (n = 0; avail > 0; n++, avail--) {
for (n = 0; avail > 0 && nm_i != hwtail_lim; n++, avail--) {
rxd_info_zero(&ri);
ri.iri_frags = rxq->ifr_frags;
ri.iri_qsidx = kring->ring_id;