net/enic: fix possible Rx corruption

Initialize the mbuf data offset to RTE_PKTMBUF_HEADROOM as the
enic takes ownership of them. If allocated mbufs had some offset
other than RTE_PKTMBUF_HEADROOM, the application would read mbuf
data starting at the wrong place and misinterpret the packet.

Fixes: 856d7ba7ed22 ("net/enic: support scattered Rx")
Reviewed-by: Nelson Escobar <neescoba@cisco.com>
Signed-off-by: John Daley <johndale@cisco.com>

diff --git a/drivers/net/enic/enic_main.c b/drivers/net/enic/enic_main.c
index 542f0952bed3ca0ef18631d632123ea5a2aba380..b4ca37104917a21f034722eba2a90235f9a19df1 100644 (file)
--- a/drivers/net/enic/enic_main.c
+++ b/drivers/net/enic/enic_main.c
@@ -317,6 +317,7 @@ enic_alloc_rx_queue_mbufs(struct enic *enic, struct vnic_rq *rq)
                        return -ENOMEM;
                }
 
+               mb->data_off = RTE_PKTMBUF_HEADROOM;
                dma_addr = (dma_addr_t)(mb->buf_physaddr
                           + RTE_PKTMBUF_HEADROOM);
                rq_enet_desc_enc(rqd, dma_addr,

diff --git a/drivers/net/enic/enic_rxtx.c b/drivers/net/enic/enic_rxtx.c
index 845a8e6691ccc57cc3f4564aa7acf53e24229a3f..50f0b2873b7999eae281bf8308ebf560890990de 100644 (file)
--- a/drivers/net/enic/enic_rxtx.c
+++ b/drivers/net/enic/enic_rxtx.c
@@ -300,6 +300,7 @@ enic_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts,
                        (struct cq_enet_rq_desc *)&cqd);
 
                /* Push descriptor for newly allocated mbuf */
+               nmb->data_off = RTE_PKTMBUF_HEADROOM;
                dma_addr = (dma_addr_t)(nmb->buf_physaddr +
                                        RTE_PKTMBUF_HEADROOM);
                rq_enet_desc_enc(rqd_ptr, dma_addr,