[PATCH] net/mlx5: fix uninitialized skip count

[PATCH] net/mlx5: fix uninitialized skip count

[Dariusz Sosnowski]

From: Kiran Vedere <kiranv@nvidia.com>

mlx5_rx_poll_len() may return MLX5_ERROR_CQE_MASK when
mlx5_rx_err_handle() reports MLX5_CQE_STATUS_HW_OWN while the Rx queue
is in IGNORE error state. In this HW_OWN case mlx5_rx_err_handle()
does not necessarily write to *skip_cnt, yet the caller (mlx5_rx_burst)
unconditionally uses skip_cnt to advance rq_ci.

This can cause rq_ci to jump by an undefined value, desynchronizing the
RQ and CQ rings and leading to persistent bad packet delivery until the
queue is reset.

Fixes: aa67ed308458 ("net/mlx5: ignore non-critical syndromes for Rx queue")
Cc: akozyrev@nvidia.com
Cc: stable@dpdk.org

Signed-off-by: Kiran Vedere <kiranv@nvidia.com>
Acked-by: Dariusz Sosnowski <dsosnowski@nvidia.com>
---
 drivers/net/mlx5/mlx5_rx.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/mlx5/mlx5_rx.c b/drivers/net/mlx5/mlx5_rx.c
index 185bfd4fff..09cd3f1ffb 100644
--- a/drivers/net/mlx5/mlx5_rx.c
+++ b/drivers/net/mlx5/mlx5_rx.c
@@ -1051,7 +1051,7 @@ mlx5_rx_burst(void *dpdk_rxq, struct rte_mbuf **pkts, uint16_t pkts_n)
 	int len = 0; /* keep its value across iterations. */
 
 	while (pkts_n) {
-		uint16_t skip_cnt;
+		uint16_t skip_cnt = 0;
 		unsigned int idx = rq_ci & wqe_mask;
 		volatile struct mlx5_wqe_data_seg *wqe =
 			&((volatile struct mlx5_wqe_data_seg *)rxq->wqes)[idx];
@@ -1497,7 +1497,7 @@ mlx5_rx_burst_mprq(void *dpdk_rxq, struct rte_mbuf **pkts, uint16_t pkts_n)
 		uint16_t strd_cnt;
 		uint16_t strd_idx;
 		uint32_t byte_cnt;
-		uint16_t skip_cnt;
+		uint16_t skip_cnt = 0;
 		volatile struct mlx5_mini_cqe8 *mcqe = NULL;
 		enum mlx5_rqx_code rxq_code;
 
-- 
2.47.3