From owner-svn-src-head@freebsd.org Thu Jul 9 10:14:04 2020 Return-Path: Delivered-To: svn-src-head@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 29163366148; Thu, 9 Jul 2020 10:14:04 +0000 (UTC) (envelope-from hps@selasky.org) Received: from mail.turbocat.net (turbocat.net [IPv6:2a01:4f8:c17:6c4b::2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 4B2X8C3NvYz3Y8s; Thu, 9 Jul 2020 10:14:03 +0000 (UTC) (envelope-from hps@selasky.org) Received: from hps2020.home.selasky.org (unknown [178.17.145.105]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mail.turbocat.net (Postfix) with ESMTPSA id 20C44260A0D; Thu, 9 Jul 2020 12:13:55 +0200 (CEST) Subject: Re: svn commit: r362962 - head/sys/net To: Mark Johnston , src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org References: <202007061452.066EqAap025536@repo.freebsd.org> From: Hans Petter Selasky Message-ID: <92dc039d-72a0-4b9d-d907-d7e310d09bc9@selasky.org> Date: Thu, 9 Jul 2020 12:13:33 +0200 User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:68.0) Gecko/20100101 Thunderbird/68.8.0 MIME-Version: 1.0 In-Reply-To: <202007061452.066EqAap025536@repo.freebsd.org> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-Rspamd-Queue-Id: 4B2X8C3NvYz3Y8s X-Spamd-Bar: -- Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=none; spf=pass (mx1.freebsd.org: domain of hps@selasky.org designates 2a01:4f8:c17:6c4b::2 as permitted sender) smtp.mailfrom=hps@selasky.org X-Spamd-Result: default: False [-2.18 / 15.00]; RCVD_VIA_SMTP_AUTH(0.00)[]; ARC_NA(0.00)[]; MID_RHS_MATCH_FROM(0.00)[]; FROM_HAS_DN(0.00)[]; RCPT_COUNT_THREE(0.00)[4]; TO_DN_SOME(0.00)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; MIME_GOOD(-0.10)[text/plain]; R_SPF_ALLOW(-0.20)[+a:mail.turbocat.net]; DMARC_NA(0.00)[selasky.org]; NEURAL_SPAM_SHORT(0.08)[0.085]; NEURAL_HAM_LONG(-1.03)[-1.026]; NEURAL_HAM_MEDIUM(-0.94)[-0.943]; FROM_EQ_ENVFROM(0.00)[]; R_DKIM_NA(0.00)[]; MIME_TRACE(0.00)[0:+]; ASN(0.00)[asn:24940, ipnet:2a01:4f8::/29, country:DE]; RCVD_COUNT_TWO(0.00)[2]; RCVD_TLS_ALL(0.00)[] X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.33 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Jul 2020 10:14:04 -0000 On 2020-07-06 16:52, Mark Johnston wrote: > Author: markj > Date: Mon Jul 6 14:52:09 2020 > New Revision: 362962 > URL: https://svnweb.freebsd.org/changeset/base/362962 > > Log: > iflib: Fix handling of mbuf cluster allocation failures. > > When refilling an rx freelist, make sure we only update the hardware > producer index if at least one cluster was allocated. Otherwise the > NIC is programmed to write a previously used cluster, typically > resulting in a use-after-free when packet data is written by the > hardware. > > Also make sure that we don't update the fragment index cursor if the > last allocation attempt didn't succeed. For at least Intel drivers, > iflib assumes that the consumer index and fragment index cursor stay in > lockstep, but this assumption was violated in the face of cluster > allocation failures. > Hi Mark, Thanks for working on this. I can confirm the issue Mellanox has seen in this area is solved by your patch. --HPS