⬢ DragonFlyBSD Kernel Audit
DF-3907 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
--- a/sys/dev/netif/xl/if_xl.c	2026-09-16 22:58:01.972006667 +0000
+++ b5/sys/dev/netif/xl/if_xl.c	2026-09-16 22:58:57.711289218 +0000
@@ -2330,14 +2330,18 @@
 
 		if (status & XL_STAT_UP_COMPLETE) {
 			u_long curpkts, ncurpkts;
+			int resyncs;
 
 			IFNET_STAT_GET(ifp, ipackets, curpkts);
-			xl_rxeof(sc, -1);
+			/* DF-3907: bound the interrupt-path rx walk */
+			xl_rxeof(sc, XL_RX_PROC_MAX);
 			IFNET_STAT_GET(ifp, ipackets, ncurpkts);
 
 			if (curpkts == ncurpkts) {
-				while (xl_rx_resync(sc))
-					xl_rxeof(sc, -1);
+				for (resyncs = 0;
+				    resyncs < XL_RX_PROC_MAX && xl_rx_resync(sc);
+				    resyncs++)
+					xl_rxeof(sc, XL_RX_PROC_MAX);
 			}
 		}
 
@@ -2613,7 +2617,7 @@
 		 * Tasking (tm) nature of their chips in all their marketing
 		 * literature;  we may as well take advantage of it. :)
 		 */
-		xl_rxeof(sc, -1);
+		xl_rxeof(sc, XL_RX_PROC_MAX);
 	}
 }
 
@@ -3120,7 +3124,7 @@
 		if_printf(ifp, "no carrier - transceiver cable problem?\n");
 	xl_txeoc(sc);
 	xl_txeof(sc);
-	xl_rxeof(sc, -1);
+	xl_rxeof(sc, XL_RX_PROC_MAX);
 	xl_reset(sc);
 	xl_init(sc);
 
--- a/sys/dev/netif/xl/if_xlreg.h	2026-09-16 22:58:01.972006667 +0000
+++ b5/sys/dev/netif/xl/if_xlreg.h	2026-09-16 22:58:57.719289115 +0000
@@ -83,6 +83,8 @@
 #define XL_CAPS_PWRMGMT		0x2000
 
 #define XL_PACKET_SIZE 1540
+/* DF-3907: max packets per interrupt-path rx walk (ifpoll already bounds) */
+#define XL_RX_PROC_MAX		64
 #ifndef ETHER_VLAN_ENCAP_LEN
 #define ETHER_VLAN_ENCAP_LEN   4
 #endif