In split queue mode the completion queue (rxq) does not own the mbuf
pool — the buffer queue (bufq2) does.  The mbuf initializer encodes
the mempool pointer, refcount and other per-pool mbuf metadata that
is stamped into every received mbuf during rearm.

Using queue->mbuf initializer reads an uninitialised or zero value
from the completion queue, corrupting every mbuf rearm.  Use
queue->bufq2->mbuf initializer to get the correct value from the
buffer queue that actually owns the mbufs.

Fixes: 1f065f9d75ff ("net/idpf: add AVX2 Rx path for split queue config")
Signed-off-by: Shaiq Wani <[email protected]>
---
 drivers/net/intel/idpf/idpf_common_rxtx_avx2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/intel/idpf/idpf_common_rxtx_avx2.c 
b/drivers/net/intel/idpf/idpf_common_rxtx_avx2.c
index 28d4246134..d3a8e17778 100644
--- a/drivers/net/intel/idpf/idpf_common_rxtx_avx2.c
+++ b/drivers/net/intel/idpf/idpf_common_rxtx_avx2.c
@@ -491,7 +491,7 @@ idpf_dp_splitq_recv_pkts_avx2(void *rxq, struct rte_mbuf 
**rx_pkts, uint16_t nb_
        struct rte_mbuf **sw_ring = &queue->bufq2->sw_ring[queue->rx_tail];
        volatile union virtchnl2_rx_desc *rxdp =
                (volatile union virtchnl2_rx_desc *)queue->rx_ring + 
queue->rx_tail;
-       const __m256i mbuf_init = _mm256_set_epi64x(0, 0, 0, 
queue->mbuf_initializer);
+       const __m256i mbuf_init = _mm256_set_epi64x(0, 0, 0, 
queue->bufq2->mbuf_initializer);
        uint64_t head_gen;
        uint16_t received = 0;
        int i;
-- 
2.34.1

Reply via email to