ixgbe: fix index overflow when resetting big Tx queues

The index of the loop was a 16-bit variable which is sufficient for
ring entries number but not for the byte size of the whole ring.
The overflow happens when queue rings are configured for 4096 entries
(descriptor size is 16 bytes). The result is an endless loop.

Signed-off-by: Intel

diff --git a/lib/librte_pmd_ixgbe/ixgbe_rxtx.c b/lib/librte_pmd_ixgbe/ixgbe_rxtx.c
index fd0885a57fae5cb8bcba95b56ba6dee24f0d0f26..cadc6a885cbe79482c25283218436e9e0cd9d2c7 100644 (file)
--- a/lib/librte_pmd_ixgbe/ixgbe_rxtx.c
+++ b/lib/librte_pmd_ixgbe/ixgbe_rxtx.c
@@ -1798,7 +1798,8 @@ static void
 ixgbe_reset_tx_queue(struct igb_tx_queue *txq)
 {
        struct igb_tx_entry *txe = txq->sw_ring;
-       uint16_t prev, i;
+       uint16_t prev;
+       uint32_t i;
 
        /* Zero out HW ring memory */
        for (i = 0; i < sizeof(union ixgbe_adv_tx_desc) * txq->nb_tx_desc; i++) {
@@ -1811,9 +1812,9 @@ ixgbe_reset_tx_queue(struct igb_tx_queue *txq)
                volatile union ixgbe_adv_tx_desc *txd = &txq->tx_ring[i];
                txd->wb.status = IXGBE_TXD_STAT_DD;
                txe[i].mbuf = NULL;
-               txe[i].last_id = i;
-               txe[prev].next_id = i;
-               prev = i;
+               txe[i].last_id = (uint16_t)i;
+               txe[prev].next_id = (uint16_t)i;
+               prev = (uint16_t)i;
        }
 
        txq->tx_next_dd = (uint16_t)(txq->tx_rs_thresh - 1);