From b60f751dde4cf2b7cd2e8a34a5de98d41dd767dd Mon Sep 17 00:00:00 2001
From: msaitoh <msaitoh@NetBSD.org>
Date: Fri, 14 May 2021 05:15:17 +0000
Subject: [PATCH] Keep m_len and m_pkthdr.len consistent to prevent panic on
 arm.

   Arm's bus_dmamap_load_mbuf() keeps a pointer to the original mbuf
  and bus_dmamap_sync() refers it. ixgbe_rxeof() modified mbuf's m_len
  inconsistently with m_pkthdr and dm_mapsize. "ifconfig down up" made
  panic by referring the inconsistent mbuf length.
---
 sys/dev/pci/ixgbe/ix_txrx.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/sys/dev/pci/ixgbe/ix_txrx.c b/sys/dev/pci/ixgbe/ix_txrx.c
index a5b6313a7104..a91eed245295 100644
--- a/sys/dev/pci/ixgbe/ix_txrx.c
+++ b/sys/dev/pci/ixgbe/ix_txrx.c
@@ -1,4 +1,4 @@
-/* $NetBSD: ix_txrx.c,v 1.73 2021/05/14 01:30:06 knakahara Exp $ */
+/* $NetBSD: ix_txrx.c,v 1.74 2021/05/14 05:15:17 msaitoh Exp $ */
 
 /******************************************************************************
 
@@ -64,7 +64,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ix_txrx.c,v 1.73 2021/05/14 01:30:06 knakahara Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ix_txrx.c,v 1.74 2021/05/14 05:15:17 msaitoh Exp $");
 
 #include "opt_inet.h"
 #include "opt_inet6.h"
@@ -1949,7 +1949,6 @@ ixgbe_rxeof(struct ix_queue *que)
 		 * buffer struct and pass this along from one
 		 * descriptor to the next, until we get EOP.
 		 */
-		mp->m_len = len;
 		/*
 		 * See if there is a stored head
 		 * that determines what we are
@@ -1958,6 +1957,7 @@ ixgbe_rxeof(struct ix_queue *que)
 		if (sendmp != NULL) {  /* secondary frag */
 			rbuf->buf = newmp;
 			rbuf->fmp = NULL;
+			mp->m_len = len;
 			mp->m_flags &= ~M_PKTHDR;
 			sendmp->m_pkthdr.len += mp->m_len;
 		} else {
@@ -1983,12 +1983,13 @@ ixgbe_rxeof(struct ix_queue *que)
 			if (sendmp == NULL) {
 				rbuf->buf = newmp;
 				rbuf->fmp = NULL;
+				mp->m_len = len;
 				sendmp = mp;
 			}
 
 			/* first desc of a non-ps chain */
 			sendmp->m_flags |= M_PKTHDR;
-			sendmp->m_pkthdr.len = mp->m_len;
+			sendmp->m_pkthdr.len = len;
 		}
 		++processed;