svn commit: r362553 - head/sys/net

[Vincenzo Maffione]

Author: vmaffione
Date: Tue Jun 23 20:23:56 2020
New Revision: 362553
URL: https://svnweb.freebsd.org/changeset/base/362553

Log:
  iflib: netmap: fix rsync index overrun
  
  In the current iflib_netmap_rxsync, there is nothing that prevents
  kring->nr_hwtail to overrun kring->nr_hwcur during the descriptor
  import phase. This may cause errors in netmap applications, such as:
  
  em1 RX0: fail 'head < kring->nr_hwcur || head > kring->nr_hwtail'
      h 795 c 795 t 282 rh 795 rc 795 rt 282 hc 282 ht 282
  
  Reviewed by:	gallatin
  MFC after:	1 week
  Differential Revision:	https://reviews.freebsd.org/D25252

Modified:
  head/sys/net/iflib.c

Modified: head/sys/net/iflib.c
==============================================================================
--- head/sys/net/iflib.c	Tue Jun 23 20:02:55 2020	(r362552)
+++ head/sys/net/iflib.c	Tue Jun 23 20:23:56 2020	(r362553)
@@ -1099,6 +1099,7 @@ iflib_netmap_rxsync(struct netmap_kring *kring, int fl
 	 * rxr->next_check is set to 0 on a ring reinit
 	 */
 	if (netmap_no_pendintr || force_update) {
+		uint32_t hwtail_lim = nm_prev(kring->nr_hwcur, lim);
 		int crclen = iflib_crcstrip ? 0 : 4;
 		int error, avail;
 
@@ -1108,7 +1109,7 @@ iflib_netmap_rxsync(struct netmap_kring *kring, int fl
 			nm_i = netmap_idx_n2k(kring, nic_i);
 			avail = ctx->isc_rxd_available(ctx->ifc_softc,
 			    rxq->ifr_id, nic_i, USHRT_MAX);
-			for (n = 0; avail > 0; n++, avail--) {
+			for (n = 0; avail > 0 && nm_i != hwtail_lim; n++, avail--) {
 				rxd_info_zero(&ri);
 				ri.iri_frags = rxq->ifr_frags;
 				ri.iri_qsidx = kring->ring_id;