igc_xmit_pkts() reserves two extra descriptors for launch time.
It indexed sw_ring[tx_last + 2] without wrapping the descriptor
index first.
If tx_last is one of the last two descriptors in the ring, this
reads past the software ring. Wrap the index before looking up
last_id.
Fixes: 2e79349dcd07 ("net/e1000: fix igc launch time calculation")
Cc: [email protected]
Signed-off-by: Shuzo Ichiyoshi <[email protected]>
---
drivers/net/intel/e1000/igc_txrx.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/net/intel/e1000/igc_txrx.c
b/drivers/net/intel/e1000/igc_txrx.c
index 1ab8f2079d..d61fdb33a8 100644
--- a/drivers/net/intel/e1000/igc_txrx.c
+++ b/drivers/net/intel/e1000/igc_txrx.c
@@ -1834,7 +1834,11 @@ igc_xmit_pkts(void *tx_queue, struct rte_mbuf **tx_pkts,
uint16_t nb_pkts)
* The "last descriptor" of the previously sent packet, if any,
* which used the last descriptor to allocate.
*/
- tx_end = sw_ring[tx_last + 2].last_id;
+ tx_end = (uint16_t)(tx_last + 2);
+ if (tx_end >= txq->nb_tx_desc)
+ tx_end = (uint16_t)(tx_end - txq->nb_tx_desc);
+
+ tx_end = sw_ring[tx_end].last_id;
/*
* The next descriptor following that "last descriptor" in the
--
2.43.0
