From: Kiran Vedere <[email protected]>
mlx5_rx_poll_len() may return MLX5_ERROR_CQE_MASK when
mlx5_rx_err_handle() reports MLX5_CQE_STATUS_HW_OWN while the Rx queue
is in IGNORE error state. In this HW_OWN case mlx5_rx_err_handle()
does not necessarily write to *skip_cnt, yet the caller (mlx5_rx_burst)
unconditionally uses skip_cnt to advance rq_ci.
This can cause rq_ci to jump by an undefined value, desynchronizing the
RQ and CQ rings and leading to persistent bad packet delivery until the
queue is reset.
Fixes: aa67ed308458 ("net/mlx5: ignore non-critical syndromes for Rx queue")
Cc: [email protected]
Cc: [email protected]
Signed-off-by: Kiran Vedere <[email protected]>
Acked-by: Dariusz Sosnowski <[email protected]>
---
drivers/net/mlx5/mlx5_rx.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/mlx5/mlx5_rx.c b/drivers/net/mlx5/mlx5_rx.c
index 185bfd4fff..09cd3f1ffb 100644
--- a/drivers/net/mlx5/mlx5_rx.c
+++ b/drivers/net/mlx5/mlx5_rx.c
@@ -1051,7 +1051,7 @@ mlx5_rx_burst(void *dpdk_rxq, struct rte_mbuf **pkts,
uint16_t pkts_n)
int len = 0; /* keep its value across iterations. */
while (pkts_n) {
- uint16_t skip_cnt;
+ uint16_t skip_cnt = 0;
unsigned int idx = rq_ci & wqe_mask;
volatile struct mlx5_wqe_data_seg *wqe =
&((volatile struct mlx5_wqe_data_seg *)rxq->wqes)[idx];
@@ -1497,7 +1497,7 @@ mlx5_rx_burst_mprq(void *dpdk_rxq, struct rte_mbuf
**pkts, uint16_t pkts_n)
uint16_t strd_cnt;
uint16_t strd_idx;
uint32_t byte_cnt;
- uint16_t skip_cnt;
+ uint16_t skip_cnt = 0;
volatile struct mlx5_mini_cqe8 *mcqe = NULL;
enum mlx5_rqx_code rxq_code;
--
2.47.3
