enic: fix offset for Rx mbuf data

The code to provide mbufs for RX used m->data_off instead of
RTE_PKTMBUF_HEADROOM as the position inside the mbuf for the data to be
written. As the mbuf is uninitialised, this could potentially cause Rx
data to be placed at the wrong address in the mbuf - or even outside it.

Fixes: 947d860c821f ("enic: improve Rx performance")
Signed-off-by: John Daley <johndale@cisco.com>

diff --git a/drivers/net/enic/enic_main.c b/drivers/net/enic/enic_main.c
index 60fe765d5c8b72869cf5d20de526f52bdd7e4333..cadc34dbbd385277cc050419468e9f9e8c540604 100644 (file)
--- a/drivers/net/enic/enic_main.c
+++ b/drivers/net/enic/enic_main.c
@@ -354,10 +354,11 @@ enic_alloc_rx_queue_mbufs(struct enic *enic, struct vnic_rq *rq)
                        return -ENOMEM;
                }
 
-               dma_addr = (dma_addr_t)(mb->buf_physaddr + mb->data_off);
+               dma_addr = (dma_addr_t)(mb->buf_physaddr
+                          + RTE_PKTMBUF_HEADROOM);
 
                rq_enet_desc_enc(rqd, dma_addr, RQ_ENET_TYPE_ONLY_SOP,
-                                mb->buf_len);
+                                mb->buf_len - RTE_PKTMBUF_HEADROOM);
                rq->mbuf_ring[i] = mb;
        }
 

diff --git a/drivers/net/enic/enic_rx.c b/drivers/net/enic/enic_rx.c
index b3ad9ea23bc1f9e74ecd7e32c57d4e5c8e44e6ed..63509e8c962a8d750f21f1b6625903de4d21dbe5 100644 (file)
--- a/drivers/net/enic/enic_rx.c
+++ b/drivers/net/enic/enic_rx.c
@@ -314,9 +314,11 @@ enic_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts,
                                 + rx_id);
 
                /* Push descriptor for newly allocated mbuf */
-               dma_addr = (dma_addr_t)(nmb->buf_physaddr + nmb->data_off);
+               dma_addr = (dma_addr_t)(nmb->buf_physaddr
+                          + RTE_PKTMBUF_HEADROOM);
                rqd_ptr->address = rte_cpu_to_le_64(dma_addr);
-               rqd_ptr->length_type = cpu_to_le16(nmb->buf_len);
+               rqd_ptr->length_type = cpu_to_le16(nmb->buf_len
+                                      - RTE_PKTMBUF_HEADROOM);
 
                /* Fill in the rest of the mbuf */
                rxmb->data_off = RTE_PKTMBUF_HEADROOM;