[Bug 240608] if_vmx(4): iflib - Panic with INVARIANTS: Memory modified after free (12.1-pre-QA)

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=240608

--- Comment #16 from Patrick Kelsey <pkelsey at freebsd.org> ---
The following commits address this bug (the commit hook missed them because
there was a typo in the reference to this bug in their commit logs):


Author: pkelsey
Date: Sat Mar 14 19:43:44 UTC 2020
New revision: 358995
URL: https://svnweb.freebsd.org/changeset/base/358995

Log:
  Fix iflib freelist state corruption

  This fixes a bug in iflib freelist management that breaks the required
  correspondence between freelist indexes and driver ring slots.

  PR:           243126, 243392, 240628
  Reported by:  avg, alexandr.oleynikov at gmail.com, Harald Schmalzbauer
  Reviewed by:  avg, gallatin
  MFC after:    1 week
  Differential Revision:        https://reviews.freebsd.org/D23943

Changes:
  head/sys/net/iflib.c



Author: pkelsey
Date: Sat Mar 14 19:55:06 UTC 2020
New revision: 358997
URL: https://svnweb.freebsd.org/changeset/base/358997

Log:
  Remove freelist contiguous-indexes assertion from rxd_frag_to_sd()

  The vmx driver is an example of an iflib driver that might report
  packets using non-contiguous descriptors (with unused descriptors
  either between received packets or between the fragments of a received
  packet), so this assertion needs to be removed.

  For such drivers, the freelist producer and consumer indexes don't
  relate directly to driver ring slots (the driver deals directly with
  freelist buffer indexes supplied by iflib during refill, and reports
  them with each fragment during packet reception), but do continue to
  be used by iflib for accounting, such as determining the number of
  ring slots that are refillable.

  PR:           243126, 243392, 240628
  Reported by:  avg, alexandr.oleynikov at gmail.com, Harald Schmalzbauer
  Reviewed by:  gallatin
  MFC after:    1 week
  Differential Revision:        https://reviews.freebsd.org/D23946

Changes:
  head/sys/net/iflib.c



Author: pkelsey
Date: Sat Mar 14 20:08:05 UTC 2020
New revision: 359000
URL: https://svnweb.freebsd.org/changeset/base/359000

Log:
  Fix if_vmx receive checksum offload bug and harden against the device
skipping receive descriptors

  This fixes a bug where the checksum offload status of received packets
  was being taken from the first descriptor instead of the last, which
  affected LRO packets.

  The driver has been hardened against the device skipping receive
  descriptors, although it is not believed that this can occur given the
  way this implementation configures the receive rings.

  Additionally, for packets received with the error indicator set, the
  driver now forces the length of all fragments in that packet to zero
  prior to passing it to iflib.  Such packets should wind up being
  discarded at some point in the stack anyway, but this removes any
  questions by killing them in the driver.

  Counters have been added (and exposed via sysctls) for skipped receive
  descriptors, zero-length packets received, and packets received with
  the error indicator set so that these conditions can be easily
  observed in the field.

  PR:           243126, 243392, 240628
  Reported by:  avg, alexandr.oleynikov at gmail.com, Harald Schmalzbauer
  Reviewed by:  gallatin
  MFC after:    1 week
  Differential Revision:        https://reviews.freebsd.org/D23949

Changes:
  head/sys/dev/vmware/vmxnet3/if_vmx.c
  head/sys/dev/vmware/vmxnet3/if_vmxvar.h

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.