svn commit: r362810 - stable/12/sys/net

[Vincenzo Maffione]

Author: vmaffione
Date: Tue Jun 30 19:34:36 2020
New Revision: 362810
URL: https://svnweb.freebsd.org/changeset/base/362810

Log:
  MFC r362553
  
  iflib: netmap: fix rsync index overrun
  
  In the current iflib_netmap_rxsync, there is nothing that prevents
  kring->nr_hwtail to overrun kring->nr_hwcur during the descriptor
  import phase. This may cause errors in netmap applications, such as:
  
  em1 RX0: fail 'head < kring->nr_hwcur || head > kring->nr_hwtail'
      h 795 c 795 t 282 rh 795 rc 795 rt 282 hc 282 ht 282
  
  Reviewed by:    gallatin
  Differential Revision:  https://reviews.freebsd.org/D25252

Modified:
  stable/12/sys/net/iflib.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/net/iflib.c
==============================================================================
--- stable/12/sys/net/iflib.c	Tue Jun 30 18:08:59 2020	(r362809)
+++ stable/12/sys/net/iflib.c	Tue Jun 30 19:34:36 2020	(r362810)
@@ -1104,6 +1104,7 @@ iflib_netmap_rxsync(struct netmap_kring *kring, int fl
 	 * rxr->next_check is set to 0 on a ring reinit
 	 */
 	if (netmap_no_pendintr || force_update) {
+		uint32_t hwtail_lim = nm_prev(kring->nr_hwcur, lim);
 		int crclen = iflib_crcstrip ? 0 : 4;
 		int error, avail;
 
@@ -1113,7 +1114,7 @@ iflib_netmap_rxsync(struct netmap_kring *kring, int fl
 			nm_i = netmap_idx_n2k(kring, nic_i);
 			avail = ctx->isc_rxd_available(ctx->ifc_softc,
 			    rxq->ifr_id, nic_i, USHRT_MAX);
-			for (n = 0; avail > 0; n++, avail--) {
+			for (n = 0; avail > 0 && nm_i != hwtail_lim; n++, avail--) {
 				rxd_info_zero(&ri);
 				ri.iri_frags = rxq->ifr_frags;
 				ri.iri_qsidx = kring->ring_id;