[PATCH] net/mana: fix CQE suppression handling on error completions

[Long Li]

On error CQEs (e.g. SA_DROP), the hardware generates one CQE per WQE
regardless of the suppression flag. The previous code honored the
suppress_tx_cqe flag unconditionally, which caused it to skip reading
error CQEs and misalign the CQ consumer index.

This misalignment causes subsequent completions to be misinterpreted:
valid CQEs are read at wrong offsets, leading to spurious error
counts, NULL packet frees, and potential use-after-free of mbufs
that were already completed.

Check the CQE type before honoring suppression: only skip CQE reading
when the completion is CQE_TX_OKAY.

Fixes: cce2c9df44 ("net/mana: suppress Tx CQE generation whenever possible")
Cc: stable at dpdk.org

Signed-off-by: Long Li <longli at microsoft.com>
---
 drivers/net/mana/tx.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/mana/tx.c b/drivers/net/mana/tx.c
index 40931ac027..e5ab566e8a 100644
--- a/drivers/net/mana/tx.c
+++ b/drivers/net/mana/tx.c
@@ -228,9 +228,11 @@ mana_tx_burst(void *dpdk_txq, struct rte_mbuf **tx_pkts, uint16_t nb_pkts)
 		txq->gdma_sq.tail += desc->wqe_size_in_bu;
 
 		/* If TX CQE suppression is used, don't read more CQE but move
-		 * on to the next packet
+		 * on to the next packet. On error CQEs, HW generates one CQE
+		 * per WQE regardless of suppression, so always advance.
 		 */
-		if (desc->suppress_tx_cqe)
+		if (desc->suppress_tx_cqe &&
+		    oob->cqe_hdr.cqe_type == CQE_TX_OKAY)
 			continue;
 
 		i++;
-- 
2.43.0