From: Borys Tsyrulnikov <tsyrulnikov.borys@gmail.com>
To: Thomas Monjalon <thomas@monjalon.net>,
Dariusz Sosnowski <dsosnowski@nvidia.com>,
Viacheslav Ovsiienko <viacheslavo@nvidia.com>,
Bing Zhao <bingz@nvidia.com>, Ori Kam <orika@nvidia.com>,
Suanming Mou <suanmingm@nvidia.com>,
Matan Azrad <matan@nvidia.com>,
Alexander Kozyrev <akozyrev@nvidia.com>
Cc: dev@dpdk.org, stable@dpdk.org,
Borys Tsyrulnikov <tsyrulnikov.borys@gmail.com>
Subject: [PATCH] net/mlx5: fix double free in vectorized Rx recovery
Date: Wed, 17 Jun 2026 16:43:01 +0300 [thread overview]
Message-ID: <20260617134301.798213-1-tsyrulnikov.borys@gmail.com> (raw)
During Rx queue error recovery, the vectorized path in
mlx5_rx_err_handle() reallocates an mbuf for every queue element. When
rte_mbuf_raw_alloc() fails (for example, the mempool is exhausted), the
rollback loop frees the mbufs allocated so far, but masks the element
ring index with "& elts_n" instead of "& (elts_n - 1)".
elts_n is a power-of-two element count, so "x & elts_n" isolates a
single bit and can only evaluate to 0 or elts_n, regardless of the loop
counter. The rollback therefore never frees the mbufs just allocated in
this pass (they are leaked); instead it repeatedly frees elts[0], a live
mbuf still posted to the NIC (use-after-free / double free), and
elts[elts_n], the fake_mbuf padding entry used by the vector datapath.
Mask with the existing e_mask (elts_n - 1), as already done in the
matching forward allocation loop just above.
Fixes: 0f20acbf5eda ("net/mlx5: implement vectorized MPRQ burst")
Cc: stable@dpdk.org
Signed-off-by: Borys Tsyrulnikov <tsyrulnikov.borys@gmail.com>
---
.mailmap | 1 +
drivers/net/mlx5/mlx5_rx.c | 2 +-
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/.mailmap b/.mailmap
index 4001e5fb0e..0b09243c45 100644
--- a/.mailmap
+++ b/.mailmap
@@ -222,6 +222,7 @@ Boleslav Stankevich <boleslav.stankevich@oktetlabs.ru>
Boon Ang <boon.ang@broadcom.com> <bang@vmware.com>
Boris Ouretskey <borisusun@gmail.com>
Boris Pismenny <borisp@mellanox.com>
+Borys Tsyrulnikov <tsyrulnikov.borys@gmail.com>
Brad Larson <bradley.larson@amd.com>
Brandon Lo <blo@iol.unh.edu>
Brendan Ryan <brendan.ryan@intel.com>
diff --git a/drivers/net/mlx5/mlx5_rx.c b/drivers/net/mlx5/mlx5_rx.c
index ce50087b70..c0ad8d6701 100644
--- a/drivers/net/mlx5/mlx5_rx.c
+++ b/drivers/net/mlx5/mlx5_rx.c
@@ -662,7 +662,7 @@ mlx5_rx_err_handle(struct mlx5_rxq_data *rxq, uint8_t vec,
if (!*elt) {
for (i--; i >= 0; --i) {
elt_idx = (elts_ci +
- i) & elts_n;
+ i) & e_mask;
elt = &(*rxq->elts)
[elt_idx];
rte_pktmbuf_free_seg
--
2.34.1
reply other threads:[~2026-06-17 13:43 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260617134301.798213-1-tsyrulnikov.borys@gmail.com \
--to=tsyrulnikov.borys@gmail.com \
--cc=akozyrev@nvidia.com \
--cc=bingz@nvidia.com \
--cc=dev@dpdk.org \
--cc=dsosnowski@nvidia.com \
--cc=matan@nvidia.com \
--cc=orika@nvidia.com \
--cc=stable@dpdk.org \
--cc=suanmingm@nvidia.com \
--cc=thomas@monjalon.net \
--cc=viacheslavo@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox