Author: vmaffione
Date: Tue Jun 30 19:34:36 2020
New Revision: 362810
URL: https://svnweb.freebsd.org/changeset/base/362810
Log:
MFC r362553
iflib: netmap: fix rsync index overrun
In the current iflib_netmap_rxsync, there is nothing that prevents
kring->nr_hwtail to overrun kring->nr_hwcur during the descriptor
import phase. This may cause errors in netmap applications, such as:
em1 RX0: fail 'head < kring->nr_hwcur || head > kring->nr_hwtail'
h 795 c 795 t 282 rh 795 rc 795 rt 282 hc 282 ht 282
Reviewed by: gallatin
Differential Revision: https://reviews.freebsd.org/D25252
Modified:
stable/12/sys/net/iflib.c
Directory Properties:
stable/12/ (props changed)
Modified: stable/12/sys/net/iflib.c
==============================================================================
--- stable/12/sys/net/iflib.c Tue Jun 30 18:08:59 2020 (r362809)
+++ stable/12/sys/net/iflib.c Tue Jun 30 19:34:36 2020 (r362810)
@@ -1104,6 +1104,7 @@ iflib_netmap_rxsync(struct netmap_kring *kring, int fl
* rxr->next_check is set to 0 on a ring reinit
*/
if (netmap_no_pendintr || force_update) {
+ uint32_t hwtail_lim = nm_prev(kring->nr_hwcur, lim);
int crclen = iflib_crcstrip ? 0 : 4;
int error, avail;
@@ -1113,7 +1114,7 @@ iflib_netmap_rxsync(struct netmap_kring *kring, int fl
nm_i = netmap_idx_n2k(kring, nic_i);
avail = ctx->isc_rxd_available(ctx->ifc_softc,
rxq->ifr_id, nic_i, USHRT_MAX);
- for (n = 0; avail > 0; n++, avail--) {
+ for (n = 0; avail > 0 && nm_i != hwtail_lim; n++,
avail--) {
rxd_info_zero(&ri);
ri.iri_frags = rxq->ifr_frags;
ri.iri_qsidx = kring->ring_id;
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
