From: Yongseok Koh <yskoh@mellanox.com>
Date: Fri, 15 Dec 2017 01:59:18 +0000 (-0800)
Subject: net/mlx5: fix overflow of Memory Region cache
X-Git-Tag: spdx-start~556
X-Git-Url: http://git.droids-corp.org/?a=commitdiff_plain;h=de48f16525e23cd04ee4c1c5b74392123529758a;p=dpdk.git

net/mlx5: fix overflow of Memory Region cache

If there're more MR(Memroy Region)'s than the size of per-queue cache, the
cache can be overflowed and corrupt the following data structure in
mlx5_txq_data.

Fixes: 6e78005a9b30 ("net/mlx5: add reference counter on DPDK Tx queues")
Cc: stable@dpdk.org

Signed-off-by: Yongseok Koh <yskoh@mellanox.com>
Acked-by: Nelio Laranjeiro <nelio.laranjeiro@6wind.com>
---

diff --git a/drivers/net/mlx5/mlx5_trigger.c b/drivers/net/mlx5/mlx5_trigger.c
index ed80a6bee0..88f60a01d4 100644
--- a/drivers/net/mlx5/mlx5_trigger.c
+++ b/drivers/net/mlx5/mlx5_trigger.c
@@ -64,8 +64,11 @@ priv_txq_start(struct priv *priv)
 
 		if (!txq_ctrl)
 			continue;
-		LIST_FOREACH(mr, &priv->mr, next)
+		LIST_FOREACH(mr, &priv->mr, next) {
 			priv_txq_mp2mr_reg(priv, &txq_ctrl->txq, mr->mp, idx++);
+			if (idx == MLX5_PMD_TX_MP_CACHE)
+				break;
+		}
 		txq_alloc_elts(txq_ctrl);
 		txq_ctrl->ibv = mlx5_priv_txq_ibv_new(priv, i);
 		if (!txq_ctrl->ibv) {