When receiving a packet that is larger than the mbuf size, the Rx function will break the receive loop and sent a free list descriptor with random DMA address.
Fix this by moving the increment of the free list descriptor counter to after the packet size have been checked and acted on. Fixes: bb340f56fcb7 ("net/nfp: fix memory leak in Rx") Cc: long...@corigine.com Cc: sta...@dpdk.org Signed-off-by: Chaoyong He <chaoyong...@corigine.com> Reviewed-by: Niklas Söderlund <niklas.soderl...@corigine.com> --- drivers/net/nfp/nfp_rxtx.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/nfp/nfp_rxtx.c b/drivers/net/nfp/nfp_rxtx.c index b8c874d315..38377ca218 100644 --- a/drivers/net/nfp/nfp_rxtx.c +++ b/drivers/net/nfp/nfp_rxtx.c @@ -293,8 +293,6 @@ nfp_net_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t nb_pkts) break; } - nb_hold++; - /* * Grab the mbuf and refill the descriptor with the * previously allocated mbuf @@ -365,6 +363,7 @@ nfp_net_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t nb_pkts) rxds->fld.dd = 0; rxds->fld.dma_addr_hi = (dma_addr >> 32) & 0xff; rxds->fld.dma_addr_lo = dma_addr & 0xffffffff; + nb_hold++; rxq->rd_p++; if (unlikely(rxq->rd_p == rxq->rx_count)) /* wrapping?*/ -- 2.29.3