From: Intel <intel.com>
Date: Fri, 8 Nov 2013 02:00:00 +0000 (+0100)
Subject: ixgbe: fix index overflow when resetting big Tx queues
X-Git-Tag: spdx-start~11075
X-Git-Url: http://git.droids-corp.org/?a=commitdiff_plain;h=bcf457f8c0d64a5c;p=dpdk.git

ixgbe: fix index overflow when resetting big Tx queues

The index of the loop was a 16-bit variable which is sufficient for
ring entries number but not for the byte size of the whole ring.
The overflow happens when queue rings are configured for 4096 entries
(descriptor size is 16 bytes). The result is an endless loop.

Signed-off-by: Intel
---

diff --git a/lib/librte_pmd_ixgbe/ixgbe_rxtx.c b/lib/librte_pmd_ixgbe/ixgbe_rxtx.c
index fd0885a57f..cadc6a885c 100644
--- a/lib/librte_pmd_ixgbe/ixgbe_rxtx.c
+++ b/lib/librte_pmd_ixgbe/ixgbe_rxtx.c
@@ -1798,7 +1798,8 @@ static void
 ixgbe_reset_tx_queue(struct igb_tx_queue *txq)
 {
 	struct igb_tx_entry *txe = txq->sw_ring;
-	uint16_t prev, i;
+	uint16_t prev;
+	uint32_t i;
 
 	/* Zero out HW ring memory */
 	for (i = 0; i < sizeof(union ixgbe_adv_tx_desc) * txq->nb_tx_desc; i++) {
@@ -1811,9 +1812,9 @@ ixgbe_reset_tx_queue(struct igb_tx_queue *txq)
 		volatile union ixgbe_adv_tx_desc *txd = &txq->tx_ring[i];
 		txd->wb.status = IXGBE_TXD_STAT_DD;
 		txe[i].mbuf = NULL;
-		txe[i].last_id = i;
-		txe[prev].next_id = i;
-		prev = i;
+		txe[i].last_id = (uint16_t)i;
+		txe[prev].next_id = (uint16_t)i;
+		prev = (uint16_t)i;
 	}
 
 	txq->tx_next_dd = (uint16_t)(txq->tx_rs_thresh - 1);