From owner-svn-src-head@freebsd.org Wed Oct 11 18:25:07 2017 Return-Path: Delivered-To: svn-src-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 04808E33296; Wed, 11 Oct 2017 18:25:07 +0000 (UTC) (envelope-from davidcs@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id C547E71970; Wed, 11 Oct 2017 18:25:06 +0000 (UTC) (envelope-from davidcs@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id v9BIP5m7016814; Wed, 11 Oct 2017 18:25:05 GMT (envelope-from davidcs@FreeBSD.org) Received: (from davidcs@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id v9BIP5Sf016812; Wed, 11 Oct 2017 18:25:05 GMT (envelope-from davidcs@FreeBSD.org) Message-Id: <201710111825.v9BIP5Sf016812@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: davidcs set sender to davidcs@FreeBSD.org using -f From: David C Somayajulu Date: Wed, 11 Oct 2017 18:25:05 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r324535 - head/sys/dev/qlxgbe X-SVN-Group: head X-SVN-Commit-Author: davidcs X-SVN-Commit-Paths: head/sys/dev/qlxgbe X-SVN-Commit-Revision: 324535 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Oct 2017 18:25:07 -0000 Author: davidcs Date: Wed Oct 11 18:25:05 2017 New Revision: 324535 URL: https://svnweb.freebsd.org/changeset/base/324535 Log: Add sanity checks in ql_hw_send() qla_send() to ensure that empty slots in Tx Ring map to empty slot in Tx_buf array before Transmits. If the checks fail further Transmission on that Tx Ring is prevented. MFC after:5 days Modified: head/sys/dev/qlxgbe/ql_hw.c head/sys/dev/qlxgbe/ql_os.c Modified: head/sys/dev/qlxgbe/ql_hw.c ============================================================================== --- head/sys/dev/qlxgbe/ql_hw.c Wed Oct 11 15:13:40 2017 (r324534) +++ head/sys/dev/qlxgbe/ql_hw.c Wed Oct 11 18:25:05 2017 (r324535) @@ -2374,6 +2374,20 @@ ql_hw_send(qla_host_t *ha, bus_dma_segment_t *segs, in } } + for (i = 0; i < num_tx_cmds; i++) { + int j; + + j = (tx_idx+i) & (NUM_TX_DESCRIPTORS - 1); + + if (NULL != ha->tx_ring[txr_idx].tx_buf[j].m_head) { + QL_ASSERT(ha, 0, \ + ("%s [%d]: txr_idx = %d tx_idx = %d mbuf = %p\n",\ + __func__, __LINE__, txr_idx, j,\ + ha->tx_ring[txr_idx].tx_buf[j].m_head)); + return (EINVAL); + } + } + tx_cmd = &hw->tx_cntxt[txr_idx].tx_ring_base[tx_idx]; if (!(mp->m_pkthdr.csum_flags & CSUM_TSO)) { Modified: head/sys/dev/qlxgbe/ql_os.c ============================================================================== --- head/sys/dev/qlxgbe/ql_os.c Wed Oct 11 15:13:40 2017 (r324534) +++ head/sys/dev/qlxgbe/ql_os.c Wed Oct 11 18:25:05 2017 (r324535) @@ -1232,6 +1232,17 @@ qla_send(qla_host_t *ha, struct mbuf **m_headp, uint32 QL_DPRINT8(ha, (ha->pci_dev, "%s: enter\n", __func__)); tx_idx = ha->hw.tx_cntxt[txr_idx].txr_next; + + if (NULL != ha->tx_ring[txr_idx].tx_buf[tx_idx].m_head) { + QL_ASSERT(ha, 0, ("%s [%d]: txr_idx = %d tx_idx = %d "\ + "mbuf = %p\n", __func__, __LINE__, txr_idx, tx_idx,\ + ha->tx_ring[txr_idx].tx_buf[tx_idx].m_head)); + if (m_head) + m_freem(m_head); + *m_headp = NULL; + return (ret); + } + map = ha->tx_ring[txr_idx].tx_buf[tx_idx].map; ret = bus_dmamap_load_mbuf_sg(ha->tx_tag, map, m_head, segs, &nsegs,