Fix a bug introduced in r199011. When bge(4) reuses loaded RX

buffers it should also reinitialize RX descriptors otherwise some
stale data could be passed to controller. This could end up with
mbuf double free or unexpected NULL pointer dereference in upper
stack. To fix the issue, save loaded buffer's length and
reinitialize RX descriptors with the saved value whenever bge(4)
reuses the loaded RX buffers.
While I'm here, increase the number of RX buffers to 512 from 256.
This simplifies RX buffer handling as well as giving more RX
buffers. Controller supports just fixed number of RX buffers
(i.e. 512) and bge(4) used to rely on hope that our CPU is fast
enough to keep up with the controller. With this change, bge(4)
will use 1MB for RX buffers but I don't think it would cause
problems in these days.

Reported by:	marcel
Tested by:	marcel

1 files changed, 2 insertions, 0 deletions

diff --git a/sys/dev/bge/if_bgereg.h b/sys/dev/bge/if_bgereg.h
index e7388bf9f965..67c045569832 100644
--- a/sys/dev/bge/if_bgereg.h
+++ b/sys/dev/bge/if_bgereg.h
@@ -2561,6 +2561,8 @@ struct bge_chain_data {
 	struct mbuf		*bge_tx_chain[BGE_TX_RING_CNT];
 	struct mbuf		*bge_rx_std_chain[BGE_STD_RX_RING_CNT];
 	struct mbuf		*bge_rx_jumbo_chain[BGE_JUMBO_RX_RING_CNT];
+	int			bge_rx_std_seglen[BGE_STD_RX_RING_CNT];
+	int			bge_rx_jumbo_seglen[BGE_JUMBO_RX_RING_CNT][4];
 };
 
 struct bge_dmamap_arg {