[PATCH 2/2] net/e1000: fix igc Tx descriptor ring wrap

[Shuzo Ichiyoshi]

igc_xmit_pkts() reserves two extra descriptors for launch time.
It indexed sw_ring[tx_last + 2] without wrapping the descriptor
index first.

If tx_last is one of the last two descriptors in the ring, this
reads past the software ring. Wrap the index before looking up
last_id.

Fixes: 2e79349dcd07 ("net/e1000: fix igc launch time calculation")
Cc: stable at dpdk.org
Signed-off-by: Shuzo Ichiyoshi <deadcafe.beef at gmail.com>
---
 drivers/net/intel/e1000/igc_txrx.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/intel/e1000/igc_txrx.c b/drivers/net/intel/e1000/igc_txrx.c
index 1ab8f2079d..d61fdb33a8 100644
--- a/drivers/net/intel/e1000/igc_txrx.c
+++ b/drivers/net/intel/e1000/igc_txrx.c
@@ -1834,7 +1834,11 @@ igc_xmit_pkts(void *tx_queue, struct rte_mbuf **tx_pkts, uint16_t nb_pkts)
 		 * The "last descriptor" of the previously sent packet, if any,
 		 * which used the last descriptor to allocate.
 		 */
-		tx_end = sw_ring[tx_last + 2].last_id;
+		tx_end = (uint16_t)(tx_last + 2);
+		if (tx_end >= txq->nb_tx_desc)
+			tx_end = (uint16_t)(tx_end - txq->nb_tx_desc);
+
+		tx_end = sw_ring[tx_end].last_id;
 
 		/*
 		 * The next descriptor following that "last descriptor" in the
-- 
2.43.0