Skip site navigation (1)Skip section navigation (2) 
Date:      Mon, 18 Apr 2016 20:33:44 +0000 (UTC)
From:      Sean Bruno <sbruno@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org
Subject:   svn commit: r298224 - in head/sys/dev: e1000 ixgbe
Message-ID:  <201604182033.u3IKXiNk001771@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: sbruno
Date: Mon Apr 18 20:33:44 2016
New Revision: 298224
URL: https://svnweb.freebsd.org/changeset/base/298224

Log:
  Correct possible underflow conditions when checking for available space
  in the tx h/w ring buffer.
  
  Reviewed by:	gnn jeb.j.cramer@intel.com
  MFC after:	1 week
  Sponsored by:	Limelight Networks
  Differential Revision:	https://reviews.freebsd.org/D5918

Modified:
  head/sys/dev/e1000/if_em.c
  head/sys/dev/e1000/if_igb.c
  head/sys/dev/e1000/if_lem.c
  head/sys/dev/ixgbe/ix_txrx.c

Modified: head/sys/dev/e1000/if_em.c
==============================================================================
--- head/sys/dev/e1000/if_em.c	Mon Apr 18 20:16:41 2016	(r298223)
+++ head/sys/dev/e1000/if_em.c	Mon Apr 18 20:33:44 2016	(r298224)
@@ -2092,7 +2092,7 @@ retry:
 		txr->tx_tso = FALSE;
 	}
 
-        if (nsegs > (txr->tx_avail - EM_MAX_SCATTER)) {
+        if (txr->tx_avail < (nsegs + EM_MAX_SCATTER)) {
                 txr->no_desc_avail++;
 		bus_dmamap_unload(txr->txtag, map);
 		return (ENOBUFS);

Modified: head/sys/dev/e1000/if_igb.c
==============================================================================
--- head/sys/dev/e1000/if_igb.c	Mon Apr 18 20:16:41 2016	(r298223)
+++ head/sys/dev/e1000/if_igb.c	Mon Apr 18 20:33:44 2016	(r298224)
@@ -1887,7 +1887,7 @@ retry:
 	}
 
 	/* Make certain there are enough descriptors */
-	if (nsegs > txr->tx_avail - 2) {
+	if (txr->tx_avail < (nsegs + 2)) {
 		txr->no_desc_avail++;
 		bus_dmamap_unload(txr->txtag, map);
 		return (ENOBUFS);

Modified: head/sys/dev/e1000/if_lem.c
==============================================================================
--- head/sys/dev/e1000/if_lem.c	Mon Apr 18 20:16:41 2016	(r298223)
+++ head/sys/dev/e1000/if_lem.c	Mon Apr 18 20:33:44 2016	(r298224)
@@ -1699,7 +1699,7 @@ lem_xmit(struct adapter *adapter, struct
 		return (error);
 	}
 
-        if (nsegs > (adapter->num_tx_desc_avail - 2)) {
+        if (adapter->num_tx_desc_avail < (nsegs + 2)) {
                 adapter->no_tx_desc_avail2++;
 		bus_dmamap_unload(adapter->txtag, map);
 		return (ENOBUFS);

Modified: head/sys/dev/ixgbe/ix_txrx.c
==============================================================================
--- head/sys/dev/ixgbe/ix_txrx.c	Mon Apr 18 20:16:41 2016	(r298223)
+++ head/sys/dev/ixgbe/ix_txrx.c	Mon Apr 18 20:33:44 2016	(r298224)
@@ -402,7 +402,7 @@ retry:
 	}
 
 	/* Make certain there are enough descriptors */
-	if (nsegs > txr->tx_avail - 2) {
+	if (txr->tx_avail < (nsegs + 2)) {
 		txr->no_desc_avail++;
 		bus_dmamap_unload(txr->txtag, map);
 		return (ENOBUFS);

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201604182033.u3IKXiNk001771>