Change Details

%%% - When refilling an rx freelist, make sure we only update the hw producer index if at least one cluster was allocated. Also make sure that we don't update the fragment index cursor if the last allocation attempt didn't succeed. For Intel drivers, iflib basically assumes that the consumer index and fragment index cursor stay in lock step, but this assumption was getting violated, resulting in use-after-frees and NULL pointer dereferences. - If we fail to allocate an mbuf header, free the already-allocated cluster. Note that we don't update the bitmap until after the header allocation succeeds, since r343481, so by bailing after an allocation failure, we leak an mbuf cluster. %%%

%%% - When refilling an rx freelist, make sure we only update the hw producer index if at least one cluster was allocated. Also make sure that we don't update the fragment index cursor if the last allocation attempt didn't succeed. For Intel drivers, iflib basically assumes that the consumer index and fragment index cursor stay in lock step, but this assumption was getting violated, resulting in use-after-frees and NULL pointer dereferences. %%%

%%% - When refilling an rx freelist, make sure we only update the hw producer index if at least one cluster was allocated. Also make sure that we don't update the fragment index cursor if the last allocation attempt didn't succeed. For Intel drivers, iflib basically assumes that the consumer index and fragment index cursor stay in lock step, but this assumption was getting violated, resulting in use-after-frees and NULL pointer dereferences. - If we fail to allocate an mbuf header, free the already-allocated cluster. Note that we don't update the bitmap until after the header allocation succeeds, since r343481, so by bailing after an allocation failure, we leak an mbuf cluster. %%%