enic: fix offset for Rx mbuf data

The code to provide mbufs for RX used m->data_off instead of
RTE_PKTMBUF_HEADROOM as the position inside the mbuf for the data to be
written. As the mbuf is uninitialised, this could potentially cause Rx
data to be placed at the wrong address in the mbuf - or even outside it.

Fixes: 947d860c821f ("enic: improve Rx performance")

Signed-off-by: John Daley <johndale@cisco.com>

diff --git a/drivers/net/enic/enic_main.c b/drivers/net/enic/enic_main.c
index 60fe765..cadc34d 100644 (file)
--- a/drivers/net/enic/enic_main.c
+++ b/drivers/net/enic/enic_main.c
@@ -354,10 +354,11 @@ enic_alloc_rx_queue_mbufs(struct enic *enic, struct vnic_rq *rq)
                        return -ENOMEM;
                }
 
-               dma_addr = (dma_addr_t)(mb->buf_physaddr + mb->data_off);
+               dma_addr = (dma_addr_t)(mb->buf_physaddr
+                          + RTE_PKTMBUF_HEADROOM);
 
                rq_enet_desc_enc(rqd, dma_addr, RQ_ENET_TYPE_ONLY_SOP,
-                                mb->buf_len);
+                                mb->buf_len - RTE_PKTMBUF_HEADROOM);
                rq->mbuf_ring[i] = mb;
        }
 

diff --git a/drivers/net/enic/enic_rx.c b/drivers/net/enic/enic_rx.c
index b3ad9ea..63509e8 100644 (file)
--- a/drivers/net/enic/enic_rx.c
+++ b/drivers/net/enic/enic_rx.c
@@ -314,9 +314,11 @@ enic_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts,
                                 + rx_id);
 
                /* Push descriptor for newly allocated mbuf */
-               dma_addr = (dma_addr_t)(nmb->buf_physaddr + nmb->data_off);
+               dma_addr = (dma_addr_t)(nmb->buf_physaddr
+                          + RTE_PKTMBUF_HEADROOM);
                rqd_ptr->address = rte_cpu_to_le_64(dma_addr);
-               rqd_ptr->length_type = cpu_to_le16(nmb->buf_len);
+               rqd_ptr->length_type = cpu_to_le16(nmb->buf_len
+                                      - RTE_PKTMBUF_HEADROOM);
 
                /* Fill in the rest of the mbuf */
                rxmb->data_off = RTE_PKTMBUF_HEADROOM;