Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 19 Oct 2017 17:35:37 +0000 (UTC)
From:      David C Somayajulu <davidcs@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org
Subject:   svn commit: r324763 - stable/10/sys/dev/qlxgbe
Message-ID:  <201710191735.v9JHZbIc063420@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: davidcs
Date: Thu Oct 19 17:35:37 2017
New Revision: 324763
URL: https://svnweb.freebsd.org/changeset/base/324763

Log:
  MFC r324535
  Add sanity checks in ql_hw_send() qla_send() to ensure that empty slots
  in Tx Ring map to empty slot in Tx_buf array before Transmits. If the
  checks fail further Transmission on that Tx Ring is prevented.

Modified:
  stable/10/sys/dev/qlxgbe/ql_hw.c
  stable/10/sys/dev/qlxgbe/ql_os.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/dev/qlxgbe/ql_hw.c
==============================================================================
--- stable/10/sys/dev/qlxgbe/ql_hw.c	Thu Oct 19 17:30:20 2017	(r324762)
+++ stable/10/sys/dev/qlxgbe/ql_hw.c	Thu Oct 19 17:35:37 2017	(r324763)
@@ -2374,6 +2374,20 @@ ql_hw_send(qla_host_t *ha, bus_dma_segment_t *segs, in
 		}
 	}
 
+	for (i = 0; i < num_tx_cmds; i++) {
+		int j;
+
+		j = (tx_idx+i) & (NUM_TX_DESCRIPTORS - 1);
+
+		if (NULL != ha->tx_ring[txr_idx].tx_buf[j].m_head) {
+			QL_ASSERT(ha, 0, \
+				("%s [%d]: txr_idx = %d tx_idx = %d mbuf = %p\n",\
+				__func__, __LINE__, txr_idx, j,\
+				ha->tx_ring[txr_idx].tx_buf[j].m_head));
+			return (EINVAL);
+		}
+	}
+
 	tx_cmd = &hw->tx_cntxt[txr_idx].tx_ring_base[tx_idx];
 
         if (!(mp->m_pkthdr.csum_flags & CSUM_TSO)) {

Modified: stable/10/sys/dev/qlxgbe/ql_os.c
==============================================================================
--- stable/10/sys/dev/qlxgbe/ql_os.c	Thu Oct 19 17:30:20 2017	(r324762)
+++ stable/10/sys/dev/qlxgbe/ql_os.c	Thu Oct 19 17:35:37 2017	(r324763)
@@ -1237,6 +1237,17 @@ qla_send(qla_host_t *ha, struct mbuf **m_headp, uint32
 	QL_DPRINT8(ha, (ha->pci_dev, "%s: enter\n", __func__));
 
 	tx_idx = ha->hw.tx_cntxt[txr_idx].txr_next;
+
+	if (NULL != ha->tx_ring[txr_idx].tx_buf[tx_idx].m_head) {
+		QL_ASSERT(ha, 0, ("%s [%d]: txr_idx = %d tx_idx = %d "\
+			"mbuf = %p\n", __func__, __LINE__, txr_idx, tx_idx,\
+			ha->tx_ring[txr_idx].tx_buf[tx_idx].m_head));
+		if (m_head)
+			m_freem(m_head);
+		*m_headp = NULL;
+		return (ret);
+	}
+
 	map = ha->tx_ring[txr_idx].tx_buf[tx_idx].map;
 
 	ret = bus_dmamap_load_mbuf_sg(ha->tx_tag, map, m_head, segs, &nsegs,



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201710191735.v9JHZbIc063420>