Date: Fri, 15 Feb 2019 10:34:28 +0000 (UTC) From: Marcin Wojtas <mw@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r344150 - head/sys/dev/ena Message-ID: <201902151034.x1FAYSVU027990@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: mw Date: Fri Feb 15 10:34:27 2019 New Revision: 344150 URL: https://svnweb.freebsd.org/changeset/base/344150 Log: Fix validation of the Rx OOO completion in the ENA Requested ID should be validated when the packet is received and not when the driver is repopulating the mbufs. Submitted by: Michal Krawczyk <mk@semihalf.com> Obtained from: Semihalf Sponsored by: Amazon, Inc. MFC after: 1 week Modified: head/sys/dev/ena/ena.c Modified: head/sys/dev/ena/ena.c ============================================================================== --- head/sys/dev/ena/ena.c Fri Feb 15 09:49:09 2019 (r344149) +++ head/sys/dev/ena/ena.c Fri Feb 15 10:34:27 2019 (r344150) @@ -1046,10 +1046,6 @@ ena_refill_rx_bufs(struct ena_ring *rx_ring, uint32_t "RX buffer - next to use: %d", next_to_use); req_id = rx_ring->free_rx_ids[next_to_use]; - rc = validate_rx_req_id(rx_ring, req_id); - if (unlikely(rc != 0)) - break; - rx_info = &rx_ring->rx_buffer_info[req_id]; rc = ena_alloc_rx_mbuf(adapter, rx_ring, rx_info); @@ -1472,6 +1468,7 @@ ena_rx_mbuf(struct ena_ring *rx_ring, struct ena_com_r struct ena_rx_buffer *rx_info; struct ena_adapter *adapter; unsigned int descs = ena_rx_ctx->descs; + int rc; uint16_t ntc, len, req_id, buf = 0; ntc = *next_to_clean; @@ -1485,6 +1482,10 @@ ena_rx_mbuf(struct ena_ring *rx_ring, struct ena_com_r len = ena_bufs[buf].len; req_id = ena_bufs[buf].req_id; + rc = validate_rx_req_id(rx_ring, req_id); + if (unlikely(rc != 0)) + return (NULL); + rx_info = &rx_ring->rx_buffer_info[req_id]; ena_trace(ENA_DBG | ENA_RXPTH, "rx_info %p, mbuf %p, paddr %jx", @@ -1517,6 +1518,16 @@ ena_rx_mbuf(struct ena_ring *rx_ring, struct ena_com_r ++buf; len = ena_bufs[buf].len; req_id = ena_bufs[buf].req_id; + rc = validate_rx_req_id(rx_ring, req_id); + if (unlikely(rc != 0)) { + /* + * If the req_id is invalid, then the device will be + * reset. In that case we must free all mbufs that + * were already gathered. + */ + m_freem(mbuf); + return (NULL); + } rx_info = &rx_ring->rx_buffer_info[req_id]; if (unlikely(rx_info->mbuf == NULL)) {
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201902151034.x1FAYSVU027990>