Author: davidcs
Date: Thu Oct 19 17:40:51 2017
New Revision: 324765
URL: https://svnweb.freebsd.org/changeset/base/324765

Log:
  MFC r324535
  Add sanity checks in ql_hw_send() qla_send() to ensure that empty slots
  in Tx Ring map to empty slot in Tx_buf array before Transmits. If the
  checks fail further Transmission on that Tx Ring is prevented.

Modified:
  stable/9/sys/dev/qlxgbe/ql_hw.c
  stable/9/sys/dev/qlxgbe/ql_os.c
Directory Properties:
  stable/9/   (props changed)
  stable/9/sys/   (props changed)

Modified: stable/9/sys/dev/qlxgbe/ql_hw.c
==============================================================================
--- stable/9/sys/dev/qlxgbe/ql_hw.c     Thu Oct 19 17:37:33 2017        
(r324764)
+++ stable/9/sys/dev/qlxgbe/ql_hw.c     Thu Oct 19 17:40:51 2017        
(r324765)
@@ -2374,6 +2374,20 @@ ql_hw_send(qla_host_t *ha, bus_dma_segment_t *segs, in
                }
        }
 
+       for (i = 0; i < num_tx_cmds; i++) {
+               int j;
+
+               j = (tx_idx+i) & (NUM_TX_DESCRIPTORS - 1);
+
+               if (NULL != ha->tx_ring[txr_idx].tx_buf[j].m_head) {
+                       QL_ASSERT(ha, 0, \
+                               ("%s [%d]: txr_idx = %d tx_idx = %d mbuf = 
%p\n",\
+                               __func__, __LINE__, txr_idx, j,\
+                               ha->tx_ring[txr_idx].tx_buf[j].m_head));
+                       return (EINVAL);
+               }
+       }
+
        tx_cmd = &hw->tx_cntxt[txr_idx].tx_ring_base[tx_idx];
 
         if (!(mp->m_pkthdr.csum_flags & CSUM_TSO)) {

Modified: stable/9/sys/dev/qlxgbe/ql_os.c
==============================================================================
--- stable/9/sys/dev/qlxgbe/ql_os.c     Thu Oct 19 17:37:33 2017        
(r324764)
+++ stable/9/sys/dev/qlxgbe/ql_os.c     Thu Oct 19 17:40:51 2017        
(r324765)
@@ -1253,6 +1253,17 @@ qla_send(qla_host_t *ha, struct mbuf **m_headp, uint32
 
 
        tx_idx = ha->hw.tx_cntxt[txr_idx].txr_next;
+
+       if (NULL != ha->tx_ring[txr_idx].tx_buf[tx_idx].m_head) {
+               QL_ASSERT(ha, 0, ("%s [%d]: txr_idx = %d tx_idx = %d "\
+                       "mbuf = %p\n", __func__, __LINE__, txr_idx, tx_idx,\
+                       ha->tx_ring[txr_idx].tx_buf[tx_idx].m_head));
+               if (m_head)
+                       m_freem(m_head);
+               *m_headp = NULL;
+               return (ret);
+       }
+
        map = ha->tx_ring[txr_idx].tx_buf[tx_idx].map;
 
        ret = bus_dmamap_load_mbuf_sg(ha->tx_tag, map, m_head, segs, &nsegs,
_______________________________________________
svn-src-stable-9@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-stable-9
To unsubscribe, send any mail to "svn-src-stable-9-unsubscr...@freebsd.org"

Reply via email to