buf_ring in HEAD is racy

K. Macy kmacy at freebsd.org
Thu Oct 30 19:39:42 UTC 2014


>
> I also suspect there are further problems with buf_ring.  A full wrap
> around of the atomically swapped value is possible. I.e. the code thinks
> it just atomically updated a head/tail index when in fact a full wrap
> around occurred leading to undefined land. A relatively simple way to
> avoid this is to only mask on ring array access, and to let the
> head/tail/prod/cons indices overflow the array.
>

Up until Rui Paulo complained to me of packet drops with buf_ring a
couple of days ago I had thought that this patch had been committed.
This patch (now 273866) fixes the problem for him. Without further
scrutiny and testing I won't provide the UL guarantee for
buf_ring_enqueue, but this is a clear improvement.

-K


More information about the freebsd-net mailing list