Author: vmaffione
Date: Tue Jun 23 20:23:56 2020
New Revision: 362553
URL: https://svnweb.freebsd.org/changeset/base/362553
Log:
iflib: netmap: fix rsync index overrun
In the current iflib_netmap_rxsync, there is nothing that prevents
kring->nr_hwtail to overrun kring->nr_hwcur during the descriptor
import phase. This may cause errors in netmap applications, such as:
em1 RX0: fail 'head < kring->nr_hwcur || head > kring->nr_hwtail'
h 795 c 795 t 282 rh 795 rc 795 rt 282 hc 282 ht 282
Reviewed by: gallatin
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D25252
Modified:
head/sys/net/iflib.c
Modified: head/sys/net/iflib.c
==============================================================================
--- head/sys/net/iflib.c Tue Jun 23 20:02:55 2020 (r362552)
+++ head/sys/net/iflib.c Tue Jun 23 20:23:56 2020 (r362553)
@@ -1099,6 +1099,7 @@ iflib_netmap_rxsync(struct netmap_kring *kring, int fl
* rxr->next_check is set to 0 on a ring reinit
*/
if (netmap_no_pendintr || force_update) {
+ uint32_t hwtail_lim = nm_prev(kring->nr_hwcur, lim);
int crclen = iflib_crcstrip ? 0 : 4;
int error, avail;
@@ -1108,7 +1109,7 @@ iflib_netmap_rxsync(struct netmap_kring *kring, int fl
nm_i = netmap_idx_n2k(kring, nic_i);
avail = ctx->isc_rxd_available(ctx->ifc_softc,
rxq->ifr_id, nic_i, USHRT_MAX);
- for (n = 0; avail > 0; n++, avail--) {
+ for (n = 0; avail > 0 && nm_i != hwtail_lim; n++,
avail--) {
rxd_info_zero(&ri);
ri.iri_frags = rxq->ifr_frags;
ri.iri_qsidx = kring->ring_id;
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
