From: John Daley <johndale@cisco.com>
Date: Wed, 27 Apr 2016 02:51:56 +0000 (-0700)
Subject: enic: fix offset for Rx mbuf data
X-Git-Tag: spdx-start~6947
X-Git-Url: http://git.droids-corp.org/?a=commitdiff_plain;h=4a3259d620f8d6eeaec2f4614556a6b00a8f4754;p=dpdk.git

enic: fix offset for Rx mbuf data

The code to provide mbufs for RX used m->data_off instead of
RTE_PKTMBUF_HEADROOM as the position inside the mbuf for the data to be
written. As the mbuf is uninitialised, this could potentially cause Rx
data to be placed at the wrong address in the mbuf - or even outside it.

Fixes: 947d860c821f ("enic: improve Rx performance")

Signed-off-by: John Daley <johndale@cisco.com>
---

diff --git a/drivers/net/enic/enic_main.c b/drivers/net/enic/enic_main.c
index 60fe765d5c..cadc34dbbd 100644
--- a/drivers/net/enic/enic_main.c
+++ b/drivers/net/enic/enic_main.c
@@ -354,10 +354,11 @@ enic_alloc_rx_queue_mbufs(struct enic *enic, struct vnic_rq *rq)
 			return -ENOMEM;
 		}
 
-		dma_addr = (dma_addr_t)(mb->buf_physaddr + mb->data_off);
+		dma_addr = (dma_addr_t)(mb->buf_physaddr
+			   + RTE_PKTMBUF_HEADROOM);
 
 		rq_enet_desc_enc(rqd, dma_addr, RQ_ENET_TYPE_ONLY_SOP,
-				 mb->buf_len);
+				 mb->buf_len - RTE_PKTMBUF_HEADROOM);
 		rq->mbuf_ring[i] = mb;
 	}
 
diff --git a/drivers/net/enic/enic_rx.c b/drivers/net/enic/enic_rx.c
index b3ad9ea23b..63509e8c96 100644
--- a/drivers/net/enic/enic_rx.c
+++ b/drivers/net/enic/enic_rx.c
@@ -314,9 +314,11 @@ enic_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts,
 				 + rx_id);
 
 		/* Push descriptor for newly allocated mbuf */
-		dma_addr = (dma_addr_t)(nmb->buf_physaddr + nmb->data_off);
+		dma_addr = (dma_addr_t)(nmb->buf_physaddr
+			   + RTE_PKTMBUF_HEADROOM);
 		rqd_ptr->address = rte_cpu_to_le_64(dma_addr);
-		rqd_ptr->length_type = cpu_to_le16(nmb->buf_len);
+		rqd_ptr->length_type = cpu_to_le16(nmb->buf_len
+				       - RTE_PKTMBUF_HEADROOM);
 
 		/* Fill in the rest of the mbuf */
 		rxmb->data_off = RTE_PKTMBUF_HEADROOM;