On Monday, June 29, 2026 12:51 PM, Shuzo Ichiyoshi <[email protected]> wrote: >igc_xmit_pkts() reserves two extra descriptors for launch time. >It indexed sw_ring[tx_last + 2] without wrapping the descriptor >index first. > >If tx_last is one of the last two descriptors in the ring, this >reads past the software ring. Wrap the index before looking up >last_id. > >Fixes: 2e79349dcd07 ("net/e1000: fix igc launch time calculation") >Cc: [email protected] >Signed-off-by: Shuzo Ichiyoshi <[email protected]>
Reviewed-by: Song Yoong Siang <[email protected]> Thanks for the fix. >--- > drivers/net/intel/e1000/igc_txrx.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > >diff --git a/drivers/net/intel/e1000/igc_txrx.c >b/drivers/net/intel/e1000/igc_txrx.c >index 1ab8f2079d..d61fdb33a8 100644 >--- a/drivers/net/intel/e1000/igc_txrx.c >+++ b/drivers/net/intel/e1000/igc_txrx.c >@@ -1834,7 +1834,11 @@ igc_xmit_pkts(void *tx_queue, struct rte_mbuf >**tx_pkts, uint16_t nb_pkts) > * The "last descriptor" of the previously sent packet, if any, > * which used the last descriptor to allocate. > */ >- tx_end = sw_ring[tx_last + 2].last_id; >+ tx_end = (uint16_t)(tx_last + 2); >+ if (tx_end >= txq->nb_tx_desc) >+ tx_end = (uint16_t)(tx_end - txq->nb_tx_desc); >+ >+ tx_end = sw_ring[tx_end].last_id; > > /* > * The next descriptor following that "last descriptor" in the >-- >2.43.0
