svn commit: r298224 - in head/sys/dev: e1000 ixgbe

Sean Bruno sbruno at FreeBSD.org
Mon Apr 18 20:33:45 UTC 2016


Author: sbruno
Date: Mon Apr 18 20:33:44 2016
New Revision: 298224
URL: https://svnweb.freebsd.org/changeset/base/298224

Log:
  Correct possible underflow conditions when checking for available space
  in the tx h/w ring buffer.
  
  Reviewed by:	gnn jeb.j.cramer at intel.com
  MFC after:	1 week
  Sponsored by:	Limelight Networks
  Differential Revision:	https://reviews.freebsd.org/D5918

Modified:
  head/sys/dev/e1000/if_em.c
  head/sys/dev/e1000/if_igb.c
  head/sys/dev/e1000/if_lem.c
  head/sys/dev/ixgbe/ix_txrx.c

Modified: head/sys/dev/e1000/if_em.c
==============================================================================
--- head/sys/dev/e1000/if_em.c	Mon Apr 18 20:16:41 2016	(r298223)
+++ head/sys/dev/e1000/if_em.c	Mon Apr 18 20:33:44 2016	(r298224)
@@ -2092,7 +2092,7 @@ retry:
 		txr->tx_tso = FALSE;
 	}
 
-        if (nsegs > (txr->tx_avail - EM_MAX_SCATTER)) {
+        if (txr->tx_avail < (nsegs + EM_MAX_SCATTER)) {
                 txr->no_desc_avail++;
 		bus_dmamap_unload(txr->txtag, map);
 		return (ENOBUFS);

Modified: head/sys/dev/e1000/if_igb.c
==============================================================================
--- head/sys/dev/e1000/if_igb.c	Mon Apr 18 20:16:41 2016	(r298223)
+++ head/sys/dev/e1000/if_igb.c	Mon Apr 18 20:33:44 2016	(r298224)
@@ -1887,7 +1887,7 @@ retry:
 	}
 
 	/* Make certain there are enough descriptors */
-	if (nsegs > txr->tx_avail - 2) {
+	if (txr->tx_avail < (nsegs + 2)) {
 		txr->no_desc_avail++;
 		bus_dmamap_unload(txr->txtag, map);
 		return (ENOBUFS);

Modified: head/sys/dev/e1000/if_lem.c
==============================================================================
--- head/sys/dev/e1000/if_lem.c	Mon Apr 18 20:16:41 2016	(r298223)
+++ head/sys/dev/e1000/if_lem.c	Mon Apr 18 20:33:44 2016	(r298224)
@@ -1699,7 +1699,7 @@ lem_xmit(struct adapter *adapter, struct
 		return (error);
 	}
 
-        if (nsegs > (adapter->num_tx_desc_avail - 2)) {
+        if (adapter->num_tx_desc_avail < (nsegs + 2)) {
                 adapter->no_tx_desc_avail2++;
 		bus_dmamap_unload(adapter->txtag, map);
 		return (ENOBUFS);

Modified: head/sys/dev/ixgbe/ix_txrx.c
==============================================================================
--- head/sys/dev/ixgbe/ix_txrx.c	Mon Apr 18 20:16:41 2016	(r298223)
+++ head/sys/dev/ixgbe/ix_txrx.c	Mon Apr 18 20:33:44 2016	(r298224)
@@ -402,7 +402,7 @@ retry:
 	}
 
 	/* Make certain there are enough descriptors */
-	if (nsegs > txr->tx_avail - 2) {
+	if (txr->tx_avail < (nsegs + 2)) {
 		txr->no_desc_avail++;
 		bus_dmamap_unload(txr->txtag, map);
 		return (ENOBUFS);


More information about the svn-src-head mailing list