Page MenuHomeFreeBSD
Files F109250469

D4234.diff
No OneTemporary
Actions

D4234.diff
View Options

Index: sys/dev/vnic/nicvf_queues.c
===================================================================
--- sys/dev/vnic/nicvf_queues.c
+++ sys/dev/vnic/nicvf_queues.c
@@ -301,8 +301,26 @@
/* Now retrieve mbuf to give to stack */
mbuf = rinfo->mbuf;
if (__predict_false(mbuf == NULL)) {
- panic("%s: Received packet fragment with NULL mbuf",
- device_get_nameunit(nic->dev));
+ /*
+ * XXX: Workaround for the rare condition when the descriptor
+ * (for the secondary fragment) obtained from HW points
+ * to an empty slot.
+ * Normally the Rx Completion Queue descriptor (CQE_RX_S)
+ * encodes the number of Receive Buffers (RB) that was
+ * used to receive the packet. Pointers to those
+ * bufferds should be placed in memory after the CQE_RX_S.
+ * Part of the received buffer is used by the system to
+ * provide buffer information such as DMA map, mbuf
+ * pointer, etc. When the mbuf pointer is empty it is
+ * assumed that the buffer comes from the used pool and
+ * needs to be refilled. Hardware should not fetch those
+ * buffers as the HEAD pointer for the RBDR pool should
+ * always point to the valid (free) buffer with the
+ * underlying mbuf. Otherwise we just drop the packet
+ * instead of calling panic().
+ */
+ if (rinfo->dmat != NULL && rinfo->dmap != NULL)
+ bus_dmamap_unload(rinfo->dmat, rinfo->dmap);
}
/*
* Clear the mbuf in the descriptor to indicate
@@ -1789,12 +1807,23 @@
/* First fragment */
mbuf = nicvf_rb_ptr_to_mbuf(nic,
(*rb_ptrs - cqe_rx->align_pad));
+ if (mbuf == NULL)
+ break;
mbuf->m_len = payload_len;
mbuf->m_data += cqe_rx->align_pad;
if_setrcvif(mbuf, nic->ifp);
} else {
/* Add fragments */
mbuf_frag = nicvf_rb_ptr_to_mbuf(nic, *rb_ptrs);
+ /*
+ * XXX: If the packet fragment is broken just drop
+ * it here.
+ */
+ if (mbuf_frag == NULL) {
+ m_freem(mbuf);
+ mbuf = NULL;
+ break;
+ }
m_append(mbuf, payload_len, mbuf_frag->m_data);
m_freem(mbuf_frag);
}

File Metadata

Mime Type
text/plain
Expires
Mon, Feb 3, 3:07 PM (21 h, 7 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
16436678
Default Alt Text
D4234.diff (2 KB)

Event Timeline