[DragonFlyBSD - Bug #3447] (New) iwm(4): replenish the RX ring before modifying the mbuf (9000-series MQ path)

[sigttou]

Issue #3447 has been reported by sigttou.

----------------------------------------
Bug #3447: iwm(4): replenish the RX ring before modifying the mbuf (9000-series MQ path)
http://bugs.dragonflybsd.org/issues/3447

* Author: sigttou
* Status: New
* Priority: Normal
* Category: Driver
* Target version: 6.6
* Start date: 2026-10-16
----------------------------------------
@iwm_rx_mpdu_mq()@ rewrites the ring's mbuf (@m_data@ advanced past the 4-byte @len_n_flags@, 4-byte command header and 48-byte @iwm_rx_mpdu_desc@, @m_len@ set to the MPDU length) before the slot is replenished. When @iwm_rx_addbuf()@ fails, the modified mbuf stays in the ring. A later frame received into that slot is then parsed 56 bytes too far into the buffer: notification parsing produces garbage (@iwm0: code XXXX, frame N/M ... unhandled@), fake command completions drain the command queue, and an INVARIANTS kernel panics with @ring->queued is empty?@ in @iwm_cmd_done at .

Observed on an Intel AC 9260 with 16 GB of RAM, where the data-path DMA tags are limited to 32-bit addresses (see the related 36-bit DMA patch).

Change: Move the @iwm_rx_addbuf()@ call before the mbuf is modified in @iwm_rx_mpdu_mq()@, like the legacy path and OpenBSD.


---Files--------------------------------
0001-iwm-4-Replenish-the-RX-ring-before-modifying-the-mbu.patch (2.07 KB)


-- 
You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: http://bugs.dragonflybsd.org/my/account