From 63a1901976b7ed8f97dac88104360371ab64dc34 Mon Sep 17 00:00:00 2001 From: davidcs Date: Thu, 19 Oct 2017 17:40:51 +0000 Subject: [PATCH] MFC r324535 Add sanity checks in ql_hw_send() qla_send() to ensure that empty slots in Tx Ring map to empty slot in Tx_buf array before Transmits. If the checks fail further Transmission on that Tx Ring is prevented. git-svn-id: svn://svn.freebsd.org/base/stable/9@324765 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f --- sys/dev/qlxgbe/ql_hw.c | 14 ++++++++++++++ sys/dev/qlxgbe/ql_os.c | 11 +++++++++++ 2 files changed, 25 insertions(+) diff --git a/sys/dev/qlxgbe/ql_hw.c b/sys/dev/qlxgbe/ql_hw.c index 07b6d7cda..102fb337b 100644 --- a/sys/dev/qlxgbe/ql_hw.c +++ b/sys/dev/qlxgbe/ql_hw.c @@ -2374,6 +2374,20 @@ ql_hw_send(qla_host_t *ha, bus_dma_segment_t *segs, int nsegs, } } + for (i = 0; i < num_tx_cmds; i++) { + int j; + + j = (tx_idx+i) & (NUM_TX_DESCRIPTORS - 1); + + if (NULL != ha->tx_ring[txr_idx].tx_buf[j].m_head) { + QL_ASSERT(ha, 0, \ + ("%s [%d]: txr_idx = %d tx_idx = %d mbuf = %p\n",\ + __func__, __LINE__, txr_idx, j,\ + ha->tx_ring[txr_idx].tx_buf[j].m_head)); + return (EINVAL); + } + } + tx_cmd = &hw->tx_cntxt[txr_idx].tx_ring_base[tx_idx]; if (!(mp->m_pkthdr.csum_flags & CSUM_TSO)) { diff --git a/sys/dev/qlxgbe/ql_os.c b/sys/dev/qlxgbe/ql_os.c index 01f14025b..6ed682b60 100644 --- a/sys/dev/qlxgbe/ql_os.c +++ b/sys/dev/qlxgbe/ql_os.c @@ -1253,6 +1253,17 @@ qla_send(qla_host_t *ha, struct mbuf **m_headp, uint32_t txr_idx, tx_idx = ha->hw.tx_cntxt[txr_idx].txr_next; + + if (NULL != ha->tx_ring[txr_idx].tx_buf[tx_idx].m_head) { + QL_ASSERT(ha, 0, ("%s [%d]: txr_idx = %d tx_idx = %d "\ + "mbuf = %p\n", __func__, __LINE__, txr_idx, tx_idx,\ + ha->tx_ring[txr_idx].tx_buf[tx_idx].m_head)); + if (m_head) + m_freem(m_head); + *m_headp = NULL; + return (ret); + } + map = ha->tx_ring[txr_idx].tx_buf[tx_idx].map; ret = bus_dmamap_load_mbuf_sg(ha->tx_tag, map, m_head, segs, &nsegs, -- 2.42.0