[PATCH] net/memif: fix descriptor flags corruption in multi-segment TX

[PATCH] net/memif: fix descriptor flags corruption in multi-segment TX

[Sriram Yagnaraman]

The memif TX path was using |= to set descriptor flags, which could
leave stale flag bits from previous ring iterations. This caused
descriptor corruption when the ring wrapped around, leading to
malformed packet chains and RX failures.

Initialize d0->flags to 0 before setting MEMIF_DESC_FLAG_NEXT to
ensure clean descriptor state on each transmission.

Fixes: 43b815d88188 ("net/memif: support zero-copy slave")
Cc: stable@dpdk.org

Signed-off-by: Sriram Yagnaraman <sriram.yagnaraman@ericsson.com>
---
 drivers/net/memif/rte_eth_memif.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/net/memif/rte_eth_memif.c b/drivers/net/memif/rte_eth_memif.c
index 8d7060cd7c..effcee3721 100644
--- a/drivers/net/memif/rte_eth_memif.c
+++ b/drivers/net/memif/rte_eth_memif.c
@@ -714,6 +714,7 @@ eth_memif_tx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
 
 next_in_chain1:
 			d0 = &ring->desc[slot & mask];
+			d0->flags = 0;
 			cp_len = rte_pktmbuf_data_len(mbuf);
 
 			rte_memcpy((uint8_t *)memif_get_buffer(proc_private, d0),
@@ -726,7 +727,7 @@ eth_memif_tx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
 
 			if (--nb_segs > 0) {
 				if (n_free) {
-					d0->flags |= MEMIF_DESC_FLAG_NEXT;
+					d0->flags = MEMIF_DESC_FLAG_NEXT;
 					mbuf = mbuf->next;
 					goto next_in_chain1;
 				} else {
@@ -747,6 +748,7 @@ eth_memif_tx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
 
 			saved_slot = slot;
 			d0 = &ring->desc[slot & mask];
+			d0->flags = 0;
 			dst_off = 0;
 			dst_len = (type == MEMIF_RING_C2S) ?
 				pmd->run.pkt_buffer_size : d0->length;
@@ -760,12 +762,12 @@ eth_memif_tx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
 					if (n_free) {
 						slot++;
 						n_free--;
-						d0->flags |= MEMIF_DESC_FLAG_NEXT;
+						d0->flags = MEMIF_DESC_FLAG_NEXT;
 						d0 = &ring->desc[slot & mask];
+						d0->flags = 0;
 						dst_off = 0;
 						dst_len = (type == MEMIF_RING_C2S) ?
 						    pmd->run.pkt_buffer_size : d0->length;
-						d0->flags = 0;
 					} else {
 						slot = saved_slot;
 						goto no_free_slots;
-- 
2.43.7

Re: [PATCH] net/memif: fix descriptor flags corruption in multi-segment TX

[Stephen Hemminger]

On Tue, 3 Mar 2026 12:01:52 +0100
Sriram Yagnaraman <sriram.yagnaraman@ericsson.com> wrote:

> The memif TX path was using |= to set descriptor flags, which could
> leave stale flag bits from previous ring iterations. This caused
> descriptor corruption when the ring wrapped around, leading to
> malformed packet chains and RX failures.
> 
> Initialize d0->flags to 0 before setting MEMIF_DESC_FLAG_NEXT to
> ensure clean descriptor state on each transmission.
> 
> Fixes: 43b815d88188 ("net/memif: support zero-copy slave")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Sriram Yagnaraman <sriram.yagnaraman@ericsson.com>
> ---

Applied to next-net

Re: [PATCH] net/memif: fix descriptor flags corruption in multi-segment TX

[Stephen Hemminger]

On Tue, 3 Mar 2026 12:01:52 +0100
Sriram Yagnaraman <sriram.yagnaraman@ericsson.com> wrote:

> The memif TX path was using |= to set descriptor flags, which could
> leave stale flag bits from previous ring iterations. This caused
> descriptor corruption when the ring wrapped around, leading to
> malformed packet chains and RX failures.
> 
> Initialize d0->flags to 0 before setting MEMIF_DESC_FLAG_NEXT to
> ensure clean descriptor state on each transmission.
> 
> Fixes: 43b815d88188 ("net/memif: support zero-copy slave")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Sriram Yagnaraman <sriram.yagnaraman@ericsson.com>

Looks good, the AI review spotted one thing.

Error: Asymmetric mbuf cleanup between the two Rx paths on truncation

In the first Rx path (fast path, around line 376), the truncation
handler frees mbuf_head and also frees the remaining pre-allocated
mbufs with rte_pktmbuf_free_bulk(mbufs + rx_pkts, MAX_PKT_BURST -
rx_pkts). 

In the second Rx path (slow path, around line 469), the
truncation handler frees mbuf_head but does NOT free the remaining
pre-allocated mbufs. If the slow path also pre-allocates mbufs into the
mbufs[] array, this is a resource leak. If the slow path does not
pre-allocate (i.e., allocates one mbuf at a time), then the asymmetry
is correct but should be verified against the full source. Without
seeing the full function, I cannot be 100% certain which case applies.
The existing mbuf == NULL failure path in the fast path (visible in the
context at line 163) also does the rte_pktmbuf_free_bulk cleanup, which
suggests the slow path may handle mbufs differently. Worth confirming
that the slow path does not leak pre-allocated mbufs on this new error
path.

Re: [PATCH] net/memif: fix descriptor flags corruption in multi-segment TX

[Sriram Yagnaraman]

On Mon, 16 Mar 2026 09:08:45 -0700
Stephen Hemminger <stephen@networkplumber.org> wrote:

> Looks good, the AI review spotted one thing.
> 
> Error: Asymmetric mbuf cleanup between the two Rx paths on truncation

Was this meant for the RX patch [1], not this TX patch?

The asymmetry is intentional. The fast path (mbuf_size >= bsize)
pre-allocates MAX_PKT_BURST mbufs via rte_pktmbuf_alloc_bulk() into a
local mbufs[] array, so on truncation we must free the unused portion
with rte_pktmbuf_free_bulk(mbufs + rx_pkts, MAX_PKT_BURST - rx_pkts).

The slow path (mbuf_size < bsize) allocates one mbuf at a time via
rte_pktmbuf_alloc() -- there is no batch array to clean up. Freeing
mbuf_head is sufficient.

[1] https://lore.kernel.org/dpdk-dev/20260316155918.3756017-1-sriram.yagnaraman@ericsson.com/