[PATCH 2/2] net/e1000: fix igc Tx descriptor ring wrap

[Song, Yoong Siang]

On Monday, June 29, 2026 12:51 PM, Shuzo Ichiyoshi <deadcafe.beef at gmail.com> wrote:
>igc_xmit_pkts() reserves two extra descriptors for launch time.
>It indexed sw_ring[tx_last + 2] without wrapping the descriptor
>index first.
>
>If tx_last is one of the last two descriptors in the ring, this
>reads past the software ring. Wrap the index before looking up
>last_id.
>
>Fixes: 2e79349dcd07 ("net/e1000: fix igc launch time calculation")
>Cc: stable at dpdk.org
>Signed-off-by: Shuzo Ichiyoshi <deadcafe.beef at gmail.com>

Reviewed-by: Song Yoong Siang <yoong.siang.song at intel.com>

Thanks for the fix.

>---
> drivers/net/intel/e1000/igc_txrx.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
>diff --git a/drivers/net/intel/e1000/igc_txrx.c
>b/drivers/net/intel/e1000/igc_txrx.c
>index 1ab8f2079d..d61fdb33a8 100644
>--- a/drivers/net/intel/e1000/igc_txrx.c
>+++ b/drivers/net/intel/e1000/igc_txrx.c
>@@ -1834,7 +1834,11 @@ igc_xmit_pkts(void *tx_queue, struct rte_mbuf
>**tx_pkts, uint16_t nb_pkts)
> 		 * The "last descriptor" of the previously sent packet, if any,
> 		 * which used the last descriptor to allocate.
> 		 */
>-		tx_end = sw_ring[tx_last + 2].last_id;
>+		tx_end = (uint16_t)(tx_last + 2);
>+		if (tx_end >= txq->nb_tx_desc)
>+			tx_end = (uint16_t)(tx_end - txq->nb_tx_desc);
>+
>+		tx_end = sw_ring[tx_end].last_id;
>
> 		/*
> 		 * The next descriptor following that "last descriptor" in the
>--
>2.43.0