When receiving a packet that is larger than the mbuf size, the Rx
function will break the receive loop and sent a free list descriptor
with random DMA address.

Fix this by moving the increment of the free list descriptor counter
to after the packet size have been checked and acted on.

Fixes: bb340f56fcb7 ("net/nfp: fix memory leak in Rx")
Cc: long...@corigine.com
Cc: sta...@dpdk.org

Signed-off-by: Chaoyong He <chaoyong...@corigine.com>
Reviewed-by: Niklas Söderlund <niklas.soderl...@corigine.com>
---
 drivers/net/nfp/nfp_rxtx.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/nfp/nfp_rxtx.c b/drivers/net/nfp/nfp_rxtx.c
index b8c874d315..38377ca218 100644
--- a/drivers/net/nfp/nfp_rxtx.c
+++ b/drivers/net/nfp/nfp_rxtx.c
@@ -293,8 +293,6 @@ nfp_net_recv_pkts(void *rx_queue, struct rte_mbuf 
**rx_pkts, uint16_t nb_pkts)
                        break;
                }
 
-               nb_hold++;
-
                /*
                 * Grab the mbuf and refill the descriptor with the
                 * previously allocated mbuf
@@ -365,6 +363,7 @@ nfp_net_recv_pkts(void *rx_queue, struct rte_mbuf 
**rx_pkts, uint16_t nb_pkts)
                rxds->fld.dd = 0;
                rxds->fld.dma_addr_hi = (dma_addr >> 32) & 0xff;
                rxds->fld.dma_addr_lo = dma_addr & 0xffffffff;
+               nb_hold++;
 
                rxq->rd_p++;
                if (unlikely(rxq->rd_p == rxq->rx_count)) /* wrapping?*/
-- 
2.29.3

Reply via email to