From cee88bcfd49cbf142c13ee7b6d2e77166c80bb48 Mon Sep 17 00:00:00 2001 From: John Daley Date: Tue, 19 Jul 2016 13:41:14 -0700 Subject: [PATCH] net/enic: fix possible Rx corruption Initialize the mbuf data offset to RTE_PKTMBUF_HEADROOM as the enic takes ownership of them. If allocated mbufs had some offset other than RTE_PKTMBUF_HEADROOM, the application would read mbuf data starting at the wrong place and misinterpret the packet. Fixes: 856d7ba7ed22 ("net/enic: support scattered Rx") Reviewed-by: Nelson Escobar Signed-off-by: John Daley --- drivers/net/enic/enic_main.c | 1 + drivers/net/enic/enic_rxtx.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/enic/enic_main.c b/drivers/net/enic/enic_main.c index 8cedebf..774fcb1 100644 --- a/drivers/net/enic/enic_main.c +++ b/drivers/net/enic/enic_main.c @@ -328,6 +328,7 @@ enic_alloc_rx_queue_mbufs(struct enic *enic, struct vnic_rq *rq) return -ENOMEM; } + mb->data_off = RTE_PKTMBUF_HEADROOM; dma_addr = (dma_addr_t)(mb->buf_physaddr + RTE_PKTMBUF_HEADROOM); rq_enet_desc_enc(rqd, dma_addr, (rq->is_sop ? RQ_ENET_TYPE_ONLY_SOP diff --git a/drivers/net/enic/enic_rxtx.c b/drivers/net/enic/enic_rxtx.c index c68bbfb..60f5062 100644 --- a/drivers/net/enic/enic_rxtx.c +++ b/drivers/net/enic/enic_rxtx.c @@ -317,7 +317,7 @@ enic_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, ciflags = enic_cq_rx_desc_ciflags((struct cq_enet_rq_desc *) &cqd); /* Push descriptor for newly allocated mbuf */ - + nmb->data_off = RTE_PKTMBUF_HEADROOM; dma_addr = (dma_addr_t)(nmb->buf_physaddr + RTE_PKTMBUF_HEADROOM); rq_enet_desc_enc(rqd_ptr, dma_addr, (rq->is_sop ? RQ_ENET_TYPE_ONLY_SOP -- 2.7.0