> -----Original Message----- > From: Pavel Ivashchenko <[email protected]> > Sent: Thursday, September 24, 2026 9:13 PM > To: [email protected] > Cc: [email protected]; Dariusz Sosnowski <[email protected]>; Slava > Ovsiienko <[email protected]>; Bing Zhao <[email protected]>; Ori Kam > <[email protected]>; Suanming Mou <[email protected]>; Matan Azrad > <[email protected]>; [email protected]; > [email protected]; NBU-Contact-Thomas Monjalon (EXTERNAL) > <[email protected]>; [email protected]; Pavel Ivashchenko > <[email protected]> > Subject: [PATCH] net/mlx5: restore fake mbuf guards on Rx replenish failure > > From: Mikhail Mamatov <[email protected]> > > Vectorized Rx keeps MLX5_VPMD_DESCS_PER_LOOP entries of elts[] pointing to > rxq->fake_mbuf after the allocated mbufs. Both rxq_cq_process_v() and > rxq_cq_decompress_v() write mbuf metadata for full SIMD groups. In particular, > CQE decompression may write through these guard entries when processing a > partial trailing group. > > Both mlx5_rx_replenish_bulk_mbuf() and > mlx5_rx_mprq_replenish_bulk_mbuf() pass the guard slots directly to > rte_mempool_get_bulk(). Since a2833ecc5ea4, the mempool get path copies > available objects from the per-lcore cache to the output array before fetching > the remaining objects from the backend. If the cache contains fewer objects > than requested and the backend cannot supply the rest, the operation restores > the cache length but leaves the output array partially overwritten. > > Returning from replenishment without restoring the guards therefore leaves > them pointing to mbufs still owned by the mempool. A later allocation can hand > these mbufs to the application, after which CQE decompression may corrupt > their metadata through the stale pointers. > > Restore the four fake mbuf pointers on allocation failure in both the regular > and > MPRQ vector Rx paths. The producer index does not advance on failure, so > restoring the guards at the original allocation position is sufficient. This > adds > work only on the allocation failure path. > > Fixes: a2833ecc5ea4 ("mempool: fix get objects from mempool with cache") > Cc: [email protected] > > Signed-off-by: Mikhail Mamatov <[email protected]> > Signed-off-by: Pavel Ivashchenko <[email protected]>
Acked-by: Dariusz Sosnowski <[email protected]> Thank you for the contribution Best regards, Dariusz Sosnowski
