git: iwm(4): Replenish the RX ring before modifying the mbuf

[Aaron LI]

commit 7d625932add5b8245f034a89ed2df5fca9a77910
Author: David Bidner <david at crap.solutions>
Date:   Thu Oct 15 11:59:09 2026 +0200

    iwm(4): Replenish the RX ring before modifying the mbuf
    
    iwm_rx_mpdu_mq() changed m_data and m_len of the RX ring mbuf before
    calling iwm_rx_addbuf().  When the replenishment failed, for example
    with ENOMEM from exhausted busdma bounce pages, it returned with the
    modified mbuf still in the ring.  The next frame received into that
    slot was then parsed 56 bytes too far in: payload was taken for
    notifications, bogus command completions drained the command queue,
    and the "ring->queued is empty?" assertion in iwm_cmd_done() fired.
    
    Replenish first, as iwm_rx_rx_mpdu() already does.
    
    See commits 96eaecf93d9f in DragonFly and 0acc104f88cc in OpenBSD.
    
    Bug: https://bugs.dragonflybsd.org/issues/3447

Summary of changes:
 sys/dev/netif/iwm/if_iwm.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/7d625932add5b8245f034a89ed2df5fca9a77910


-- 
DragonFly BSD source repository