net/mlx5: fix overflow of Memory Region cache

If there're more MR(Memroy Region)'s than the size of per-queue cache, the
cache can be overflowed and corrupt the following data structure in
mlx5_txq_data.

Fixes: 6e78005a9b30 ("net/mlx5: add reference counter on DPDK Tx queues")
Cc: stable@dpdk.org
Signed-off-by: Yongseok Koh <yskoh@mellanox.com>
Acked-by: Nelio Laranjeiro <nelio.laranjeiro@6wind.com>

diff --git a/drivers/net/mlx5/mlx5_trigger.c b/drivers/net/mlx5/mlx5_trigger.c
index ed80a6b..88f60a0 100644 (file)
--- a/drivers/net/mlx5/mlx5_trigger.c
+++ b/drivers/net/mlx5/mlx5_trigger.c
@@ -64,8 +64,11 @@ priv_txq_start(struct priv *priv)
 
                if (!txq_ctrl)
                        continue;
-               LIST_FOREACH(mr, &priv->mr, next)
+               LIST_FOREACH(mr, &priv->mr, next) {
                        priv_txq_mp2mr_reg(priv, &txq_ctrl->txq, mr->mp, idx++);
+                       if (idx == MLX5_PMD_TX_MP_CACHE)
+                               break;
+               }
                txq_alloc_elts(txq_ctrl);
                txq_ctrl->ibv = mlx5_priv_txq_ibv_new(priv, i);
                if (!txq_ctrl->ibv) {