DF-1381 / fix.diff
diff --git a/sys/dev/netif/vge/if_vge.c b/sys/dev/netif/vge/if_vge.c --- a/sys/dev/netif/vge/if_vge.c +++ b/sys/dev/netif/vge/if_vge.c @@ -1160,7 +1160,15 @@ #define VGE_RXCHUNK 4 sc->vge_rx_consumed++; if (sc->vge_rx_consumed == VGE_RXCHUNK) { - for (i = idx; i != idx - sc->vge_rx_consumed; i--) { + int j; + /* + * Set the OWN bit on the last VGE_RXCHUNK descriptors ending at + * idx, wrapping modularly around the ring. The original signed + * 'i != idx - consumed' loop underflowed to negative indices when + * idx < VGE_RXCHUNK, writing before the DMA allocation (DF-1381). + */ + for (i = idx, j = 0; j < VGE_RXCHUNK; j++, + i = (i - 1 + VGE_RX_DESC_CNT) % VGE_RX_DESC_CNT) { sc->vge_ldata.vge_rx_list[i].vge_sts |= htole32(VGE_RDSTS_OWN); } |