iflib: Fix several memory handling issues around iflib_encap()

- Fixed memory leaks around m_dup() not freeing the original chain on
  failure. If we return ENOMEM, we are expected to have freed the
  chain, else the mbuf would be leaked. Also updated iflib_ether_pad()
  to follow the same structure.

- In iflib_parse_header()
    o Fixed a bug where the ip/ip6 and th pointers may point into a
      freed chain after m_pullup.  Those pointers must be reset to
      point into the new chain.

    o Eliminate ENXIO returns for non-TCP TSO sends (which would violate
      the mbuf ownership contract if they could happen). Since they
      cannot happen, I made them assertions instead.

- in iflib_ether_pad(), return ENOMEM after freeing mbuf, so that
  mp_ring knows it is free. An ENOBUFS error will cause the mp_ring
  path to retain the mbuf and retry

- in iflib_encap():
     o Fix a leak when bus_dmamap_load_mbuf_sg() returns ENOMEM
     o Fix a use-after-free in the mp_ring path when a driver using
       ktls frees an mbuf and returns ENOBUFS via iflib_encap()

After this change the expection from iflib_encap is that:

mp_ring: ENOBUFS can be returned only when we run out of descriptors
	 (ENOBUFS causes mp_ring to retain the mbuf).

simple_tx: iflib_encap() always consumes the mbuf, regardless of the
	   return

Note that iflib_debugnet_transmit(), like simple_tx, expects that
iflib_encap() always consumes mbufs.  This will be true after mp_ring
is removed, and its such a rare special case (overrunning the ring
during panic dumps) that I don't think its worth fixing in the
meantime.

Sponsored by: Netflix
Reviewed by: kbowling, sumit.saxena_broadcom.com
Differential Revision: https://reviews.freebsd.org/D58843
Fixes: 074ff8746388

0 files changed, 0 insertions, 0 deletions