On Sat, 9 May 2026 14:29:29 +0800 Junlong Wang <[email protected]> wrote:
> Add simple Tx xmit functions (zxdh_xmit_pkts_simple) > for single-segment packet xmit. > > Signed-off-by: Junlong Wang <[email protected]> > --- Some AI review feedback. PATCH v3 3/3] net/zxdh: optimize Tx xmit pkts performance Error: NULL pointer dereference in pkt_padding() hdr = (struct zxdh_net_hdr_dl *)rte_pktmbuf_prepend(cookie, hdr_len); rte_memcpy(hdr, net_hdr_dl, hdr_len); rte_pktmbuf_prepend() returns NULL when headroom is insufficient. The existing zxdh_xmit_pkts_packed() path guards its push fast-path with txm->data_off >= ZXDH_DL_NET_HDR_SIZE and falls back to the indirect path when that fails. The simple Tx path has no such guard; any mbuf submitted with headroom < hw->dl_net_hdr_len will crash here. Add a NULL check, or screen mbufs with insufficient headroom in zxdh_xmit_pkts_simple() before calling submit_to_backend_simple(). Error: out-of-bounds read in zxdh_xmit_pkts_simple() stats loop if ((vq->vq_avail_idx + nb_pkts) >= vq->vq_nentries) { nb_tx = vq->vq_nentries - vq->vq_avail_idx; nb_tx_left = nb_pkts - nb_tx; submit_to_backend_simple(vq, tx_pkts, nb_tx); ... tx_pkts += nb_tx; } if (nb_tx_left) { submit_to_backend_simple(vq, tx_pkts, nb_tx_left); ... } zxdh_queue_notify(vq); txvq->stats.packets += nb_pkts; for (nb_tx = 0; nb_tx < nb_pkts; nb_tx++) zxdh_update_packet_stats(&txvq->stats, tx_pkts[nb_tx]); When the ring wraps within a burst, tx_pkts is advanced past the first chunk. The stats loop then walks nb_pkts entries from the advanced pointer, reading past the end of the caller's mbuf array. The first chunk's per-packet stats are also skipped. Use a separate cursor for the submit calls and iterate the stats loop over the original tx_pkts, or accumulate per-packet stats inside each submit step.
