- When refilling an rx freelist, make sure we only update the hw
producer index if at least one cluster was allocated. Also make sure
that we don't update the fragment index cursor if the last allocation
attempt didn't succeed. For Intel drivers, iflib basically assumes
that the consumer index and fragment index cursor stay in lock step,
but this assumption was getting violated, resulting in use-after-frees
and NULL pointer dereferences.
- If we fail to allocate an mbuf header, free the already-allocated
cluster. Note that we don't update the bitmap until after the header
allocation succeeds, since r343481, so by bailing after an allocation
failure, we leak an mbuf cluster.