svn commit: r344150 - head/sys/dev/ena

[Marcin Wojtas]

Author: mw
Date: Fri Feb 15 10:34:27 2019
New Revision: 344150
URL: https://svnweb.freebsd.org/changeset/base/344150

Log:
  Fix validation of the Rx OOO completion in the ENA
  
  Requested ID should be validated when the packet is received and not
  when the driver is repopulating the mbufs.
  
  Submitted by: Michal Krawczyk <mk at semihalf.com>
  Obtained from: Semihalf
  Sponsored by: Amazon, Inc.
  MFC after: 1 week

Modified:
  head/sys/dev/ena/ena.c

Modified: head/sys/dev/ena/ena.c
==============================================================================
--- head/sys/dev/ena/ena.c	Fri Feb 15 09:49:09 2019	(r344149)
+++ head/sys/dev/ena/ena.c	Fri Feb 15 10:34:27 2019	(r344150)
@@ -1046,10 +1046,6 @@ ena_refill_rx_bufs(struct ena_ring *rx_ring, uint32_t 
 		    "RX buffer - next to use: %d", next_to_use);
 
 		req_id = rx_ring->free_rx_ids[next_to_use];
-		rc = validate_rx_req_id(rx_ring, req_id);
-		if (unlikely(rc != 0))
-			break;
-
 		rx_info = &rx_ring->rx_buffer_info[req_id];
 
 		rc = ena_alloc_rx_mbuf(adapter, rx_ring, rx_info);
@@ -1472,6 +1468,7 @@ ena_rx_mbuf(struct ena_ring *rx_ring, struct ena_com_r
 	struct ena_rx_buffer *rx_info;
 	struct ena_adapter *adapter;
 	unsigned int descs = ena_rx_ctx->descs;
+	int rc;
 	uint16_t ntc, len, req_id, buf = 0;
 
 	ntc = *next_to_clean;
@@ -1485,6 +1482,10 @@ ena_rx_mbuf(struct ena_ring *rx_ring, struct ena_com_r
 
 	len = ena_bufs[buf].len;
 	req_id = ena_bufs[buf].req_id;
+	rc = validate_rx_req_id(rx_ring, req_id);
+	if (unlikely(rc != 0))
+		return (NULL);
+
 	rx_info = &rx_ring->rx_buffer_info[req_id];
 
 	ena_trace(ENA_DBG | ENA_RXPTH, "rx_info %p, mbuf %p, paddr %jx",
@@ -1517,6 +1518,16 @@ ena_rx_mbuf(struct ena_ring *rx_ring, struct ena_com_r
 		++buf;
 		len = ena_bufs[buf].len;
 		req_id = ena_bufs[buf].req_id;
+		rc = validate_rx_req_id(rx_ring, req_id);
+		if (unlikely(rc != 0)) {
+			/*
+			 * If the req_id is invalid, then the device will be
+			 * reset. In that case we must free all mbufs that
+			 * were already gathered.
+			 */
+			m_freem(mbuf);
+			return (NULL);
+		}
 		rx_info = &rx_ring->rx_buffer_info[req_id];
 
 		if (unlikely(rx_info->mbuf == NULL)) {