From nobody Tue Sep 29 20:17:45 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hvTxq2SNrz6v6dR for ; Tue, 29 Sep 2026 20:17:51 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hvTxp6RvFz4rNl for ; Tue, 29 Sep 2026 20:17:50 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790713070; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ORi4v+pvxy2JAth0CiMu4xv+e7UrF/JyMl5/iMEkVBg=; b=PEd20xKNFe5M7S0QrL2IppdNP4Ph8cRujqZ5nSCWGZq2UvRMagK0DwJAruXGJLC1ScrBCg vDdWE6tR++iYRbE6OiTMnKIWOrTaP5W0Eq40YVIMHArqUYs+BfYgR1XCiu3xFMeRZbwq2f 4yXKdjz5HO+oa0MClzKC8RYn9hPkWxhw88Xfw1Go03j8oap8ibUj8fdv2UWUN6zKyK1RTv raE0dAuB8vd7QYWFbnECXO85rIZORYdxGGcBZObcwy10lThTms5o1gYL6G3k7ir54/iWW6 X5eajN+rLIjhumN3566j2n2DOnE9IafwlZdA6UOpPXHFmRf4/FSnuLDSrkOSIw== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1790713070; b=R+P3lVhmLDl1e/iSBJ7rCfxyEmL9fviGneNlZJy8XD12WFYjJ2uJh0RqHRU/ikpahbZOEh vVGnSG8QqRPjRWYwQXBjKvSQZFG9BRqhoZUidjIu50BtoZBSwLbyIBPhQpPdX24LKPK4Zt ZxIcqb0LScVsSvSarlhxkVU1hSM3C0c7RMbVL3tBcpiqFTKdb1eKlTGa84C+Is3oSaVPG/ mh1gCa3ZGOkzsjzAjtnEW0urPa4R1FWY0LpjvetmTtOt6sYePuh4Cs2vcuOhfxLDtzCtdk nda6HmAse8grKbS3ouFaD628z/nfNhSMHXrhoBrJzBZ4SAtE25y1obCqDmiU3A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790713070; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ORi4v+pvxy2JAth0CiMu4xv+e7UrF/JyMl5/iMEkVBg=; b=cwQ+gGuJNESeV+ag4Dug1Th1yfsbucyFKbqa9y3yL1JGtpgsw0Mx1M/oaNz4sX+lnuin0j TUvhgPLkUytKw+qB9pWQBz/iFlbdd/5LfObaycYMNEmZdW5UVKjQfDv+B2TrS4PzBuzAZm XMEPj17Payy8jG7BCnV08gx+LB+S4gdVFyVNvZENVTDYnwOjNAwF703pxIdxa0rDFZtftu 7BAOGieKIODVlQJECMnXqpQkCc/DGTSriXanYaCtZoa9dJrAFt8T/aMeELvA8kMwIKieu+ YRfs/INMdyYM9drRNItjXTr+UUD/R12Uu91JkD5yH3c4q1JX0quEexXszdjrMg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hvTxp44jlzDbp for ; Tue, 29 Sep 2026 20:17:50 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1c433 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 29 Sep 2026 20:17:45 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: Andrew Griffiths From: Mark Johnston Subject: git: 669cd0d90ee7 - main - rge: Preserve replacement mbufs after defragmentation List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 669cd0d90ee7b5bed794ded5fa00b6be854a6598 Auto-Submitted: auto-generated Date: Tue, 29 Sep 2026 20:17:45 +0000 Message-Id: <6abc1ce9.1c433.74550f4a@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=669cd0d90ee7b5bed794ded5fa00b6be854a6598 commit 669cd0d90ee7b5bed794ded5fa00b6be854a6598 Author: Andrew Griffiths AuthorDate: 2026-09-29 20:11:31 +0000 Commit: Mark Johnston CommitDate: 2026-09-29 20:14:12 +0000 rge: Preserve replacement mbufs after defragmentation m_defrag() has pointer-return ownership semantics: success frees the original chain and returns a replacement, while failure returns NULL and leaves the original owned by the caller. rge_encap() compared that pointer as an integer status and could return failure after success, causing rge_tx_task() to free its stale old head. Pass the mbuf by reference, retain the replacement returned by m_defrag(), and publish it to the caller before retrying DMA mapping. A later mapping failure is then cleaned up through the current chain, and a successful transmission uses that same chain for BPF and TX ownership. An unprivileged process can reach the EFBIG branch in mapped-sendfile mode. Signed-off-by: Andrew Griffiths Reviewed by: adrian, markj MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D60142 --- sys/dev/rge/if_rge.c | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-) diff --git a/sys/dev/rge/if_rge.c b/sys/dev/rge/if_rge.c index 7c11da5c3f53..89287450a01d 100644 --- a/sys/dev/rge/if_rge.c +++ b/sys/dev/rge/if_rge.c @@ -766,18 +766,20 @@ rge_tx_list_sync(struct rge_softc *sc, struct rge_queues *q, * * @param sc driver softc * @param q TX queue ring - * @param m mbuf to enqueue + * @param mp mbuf to enqueue, updated if defragmentation replaces it * @returns if the mbuf is enqueued, it's consumed here and the number of * TX descriptors used is returned; if there's no space then 0 is - * returned; if the mbuf couldn't be defragged and the caller - * should free it then -1 is returned. + * returned; if the mbuf couldn't be mapped and the caller should + * free it then -1 is returned. */ static int -rge_encap(struct rge_softc *sc, struct rge_queues *q, struct mbuf *m, int idx) +rge_encap(struct rge_softc *sc, struct rge_queues *q, struct mbuf **mp, + int idx) { struct rge_tx_desc *d = NULL; struct rge_txq *txq; bus_dmamap_t txmap; + struct mbuf *m; uint32_t cmdsts, cflags = 0; int cur, error, i; bus_dma_segment_t seg[RGE_TX_NSEGS]; @@ -785,6 +787,7 @@ rge_encap(struct rge_softc *sc, struct rge_queues *q, struct mbuf *m, int idx) RGE_ASSERT_LOCKED(sc); + m = *mp; txq = &q->q_tx.rge_txq[idx]; txmap = txq->txq_dmamap; @@ -800,10 +803,13 @@ rge_encap(struct rge_softc *sc, struct rge_queues *q, struct mbuf *m, int idx) case EFBIG: /* mbuf chain is too fragmented */ sc->sc_drv_stats.tx_encap_refrag_cnt++; nsegs = RGE_TX_NSEGS; - if (m_defrag(m, M_NOWAIT) == 0 && - bus_dmamap_load_mbuf_sg(sc->sc_dmat_tx_buf, txmap, m, - seg, &nsegs, BUS_DMA_NOWAIT) == 0) - break; + m = m_defrag(m, M_NOWAIT); + if (m != NULL) { + *mp = m; + if (bus_dmamap_load_mbuf_sg(sc->sc_dmat_tx_buf, txmap, + m, seg, &nsegs, BUS_DMA_NOWAIT) == 0) + break; + } /* FALLTHROUGH */ default: sc->sc_drv_stats.tx_encap_err_toofrag++; @@ -2498,8 +2504,8 @@ rge_tx_task(void *arg, int npending) if (m == NULL) break; - /* Attempt to encap */ - used = rge_encap(sc, q, m, idx); + /* Attempt to encap, m might change due to defrag */ + used = rge_encap(sc, q, &m, idx); if (used < 0) { if_inc_counter(sc->sc_ifp, IFCOUNTER_OQDROPS, 1); m_freem(m);