⬢ DragonFlyBSD Kernel Audit
DF-3904 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
--- a/sys/dev/netif/sk/if_sk.c	2026-09-16 22:58:01.968006718 +0000
+++ b3/sys/dev/netif/sk/if_sk.c	2026-09-16 22:58:38.999529949 +0000
@@ -1806,7 +1806,7 @@
 	struct ifnet *ifp = &sc_if->arpcom.ac_if;
 	struct sk_chain_data *cd = &sc_if->sk_cdata;
 	struct sk_ring_data *rd = &sc_if->sk_rdata;
-	int i, max_frmlen;
+	int i, max_frmlen, rx_npkts = 0;
 
 	DPRINTFN(2, ("sk_rxeof\n"));
 
@@ -1826,6 +1826,19 @@
 		int cur, total_len;
 		struct mbuf *m;
 
+		if (rx_npkts >= SK_RX_PROC_MAX) {
+			/*
+			 * DF-3904: leave the rest of the ring to the next
+			 * interrupt; a line-rate flood otherwise keeps the
+			 * walk running forever under the serializer (RX
+			 * livelock; msk(4) bounds the same walk via
+			 * mskc.process_limit).
+			 */
+			cd->sk_rx_prod = i;
+			break;
+		}
+		rx_npkts++;
+
 		cur = i;
 		cur_desc = &rd->sk_rx_ring[cur];
 
--- a/sys/dev/netif/sk/if_skreg.h	2026-09-16 22:58:01.968006718 +0000
+++ b3/sys/dev/netif/sk/if_skreg.h	2026-09-16 22:58:39.007529848 +0000
@@ -1336,6 +1336,8 @@
 #define SK_TXBYTES		SK_RXBYTES
 
 #define SK_TX_RING_CNT		512
+/* DF-3904: max RX packets processed per interrupt */
+#define SK_RX_PROC_MAX		64
 #define SK_RX_RING_CNT		256
 
 /*