[PATCH 0/1] Fix CN20K mbuf size truncation

[PATCH 0/1] Fix CN20K mbuf size truncation

[Randy L Tice]

This small fix prepares the CN20K inline security receive paths for mbuf
layouts larger than 255 bytes.

The affected code recovers a packet mbuf by subtracting the size of
struct rte_mbuf from a pointer stored in completion metadata. Keeping
that size in an 8-bit local variable makes the recovery sensitive to
future mbuf layout growth. The patch widens the local size variable
without changing the surrounding fast-path logic.

The issue was found while preparing an unrelated mbuf layout extension.

Randy L Tice (1):
  drivers: fix CN20K mbuf size truncation

 .mailmap                          | 1 +
 drivers/event/cnxk/cn20k_worker.h | 4 ++--
 drivers/net/cnxk/cn20k_rx.h       | 4 ++--
 3 files changed, 5 insertions(+), 4 deletions(-)

-- 
2.35.6

[PATCH 1/1] drivers: fix CN20K mbuf size truncation

[Randy L Tice]

CN20K inline security receive paths recover the packet mbuf by
subtracting sizeof(struct rte_mbuf) from a pointer stored in
completion metadata.

The size is currently kept in a uint8_t local variable before
that subtraction. This truncates the value when the mbuf structure
grows beyond 255 bytes, and can recover the wrong mbuf address.

Use a uint32_t local value for the mbuf byte size so larger mbuf
layouts are handled correctly.

Fixes: 5856f23129bb ("net/cnxk: support CN20K inline IPsec Rx")
Fixes: edd0d5f3c299 ("event/cnxk: support CN20K inline IPsec Rx")
Cc: stable@dpdk.org

Signed-off-by: Randy L Tice <rtice@cisco.com>
---
 .mailmap                          | 1 +
 drivers/event/cnxk/cn20k_worker.h | 4 ++--
 drivers/net/cnxk/cn20k_rx.h       | 4 ++--
 3 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/.mailmap b/.mailmap
index fcb3d1bb3f..2a8b54ea23 100644
--- a/.mailmap
+++ b/.mailmap
@@ -1379,6 +1379,7 @@ Rakesh Kudurumalla <rkudurumalla@marvell.com> <rkudurumalla@caviumnetworks.com>
 Ralf Hoffmann <ralf.hoffmann@allegro-packets.com>
 Rami Rosen <ramirose@gmail.com> <rami.rosen@intel.com>
 Rami Rosen <ramirose@gmail.com> <roszenrami@gmail.com>
+Randy L Tice <rtice@cisco.com>
 Randy Schacher <stuart.schacher@broadcom.com>
 Rani Sharoni <ranish@nvidia.com>
 Ranjit Menon <ranjit.menon@intel.com>
diff --git a/drivers/event/cnxk/cn20k_worker.h b/drivers/event/cnxk/cn20k_worker.h
index 6442113e09..5723a6eabb 100644
--- a/drivers/event/cnxk/cn20k_worker.h
+++ b/drivers/event/cnxk/cn20k_worker.h
@@ -48,7 +48,7 @@ cn20k_process_vwqe(uintptr_t vwqe, uint16_t port_id, const uint32_t flags, struc
 {
 	uint64_t mbuf_init = 0x100010000ULL | RTE_PKTMBUF_HEADROOM;
 	struct cnxk_timesync_info *tstamp = ws->tstamp[port_id];
-	uint8_t m_sz = sizeof(struct rte_mbuf);
+	const uint32_t m_sz = sizeof(struct rte_mbuf);
 	void *lookup_mem = ws->lookup_mem;
 	uint64_t meta_aura = 0, laddr = 0;
 	uintptr_t lbase = ws->lmt_base;
@@ -165,7 +165,7 @@ cn20k_process_vwqe(uintptr_t vwqe, uint16_t port_id, const uint32_t flags, struc
 static __rte_always_inline void
 cn20k_sso_hws_post_process(struct cn20k_sso_hws *ws, uint64_t *u64, const uint32_t flags)
 {
-	uint8_t m_sz = sizeof(struct rte_mbuf);
+	const uint32_t m_sz = sizeof(struct rte_mbuf);
 	uintptr_t sa_base = 0;
 
 	u64[0] = (u64[0] & (0x3ull << 32)) << 6 | (u64[0] & (0x3FFull << 36)) << 4 |
diff --git a/drivers/net/cnxk/cn20k_rx.h b/drivers/net/cnxk/cn20k_rx.h
index f8fa6de2b9..b544868c03 100644
--- a/drivers/net/cnxk/cn20k_rx.h
+++ b/drivers/net/cnxk/cn20k_rx.h
@@ -702,7 +702,7 @@ cn20k_nix_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t pkts, co
 	uint64_t mbuf_init = rxq->mbuf_initializer;
 	const void *lookup_mem = rxq->lookup_mem;
 	const uint64_t data_off = rxq->data_off;
-	uint8_t m_sz = sizeof(struct rte_mbuf);
+	const uint32_t m_sz = sizeof(struct rte_mbuf);
 	const uint64_t wdata = rxq->wdata;
 	const uint32_t qmask = rxq->qmask;
 	const uintptr_t desc = rxq->desc;
@@ -815,7 +815,7 @@ cn20k_nix_flush_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t pk
 	uint64_t mbuf_init = rxq->mbuf_initializer;
 	const void *lookup_mem = rxq->lookup_mem;
 	const uint64_t data_off = rxq->data_off;
-	uint8_t m_sz = sizeof(struct rte_mbuf);
+	const uint32_t m_sz = sizeof(struct rte_mbuf);
 	const uint64_t wdata = rxq->wdata;
 	const uint32_t qmask = rxq->qmask;
 	const uintptr_t desc = rxq->desc;
-- 
2.35.6

Re: [PATCH 1/1] drivers: fix CN20K mbuf size truncation

[Stephen Hemminger]

[-- Attachment #1: Type: text/plain, Size: 4012 bytes --]

stop "cargo culting" use of always inline attribute. that attribute should
only be used in special cases where code breaks compilation without it. it
is not a go faster flag

On Wed, Sep 9, 2026, 09:06 Randy L Tice <rtice@cisco.com> wrote:

> CN20K inline security receive paths recover the packet mbuf by
> subtracting sizeof(struct rte_mbuf) from a pointer stored in
> completion metadata.
>
> The size is currently kept in a uint8_t local variable before
> that subtraction. This truncates the value when the mbuf structure
> grows beyond 255 bytes, and can recover the wrong mbuf address.
>
> Use a uint32_t local value for the mbuf byte size so larger mbuf
> layouts are handled correctly.
>
> Fixes: 5856f23129bb ("net/cnxk: support CN20K inline IPsec Rx")
> Fixes: edd0d5f3c299 ("event/cnxk: support CN20K inline IPsec Rx")
> Cc: stable@dpdk.org
>
> Signed-off-by: Randy L Tice <rtice@cisco.com>
> ---
>  .mailmap                          | 1 +
>  drivers/event/cnxk/cn20k_worker.h | 4 ++--
>  drivers/net/cnxk/cn20k_rx.h       | 4 ++--
>  3 files changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/.mailmap b/.mailmap
> index fcb3d1bb3f..2a8b54ea23 100644
> --- a/.mailmap
> +++ b/.mailmap
> @@ -1379,6 +1379,7 @@ Rakesh Kudurumalla <rkudurumalla@marvell.com> <
> rkudurumalla@caviumnetworks.com>
>  Ralf Hoffmann <ralf.hoffmann@allegro-packets.com>
>  Rami Rosen <ramirose@gmail.com> <rami.rosen@intel.com>
>  Rami Rosen <ramirose@gmail.com> <roszenrami@gmail.com>
> +Randy L Tice <rtice@cisco.com>
>  Randy Schacher <stuart.schacher@broadcom.com>
>  Rani Sharoni <ranish@nvidia.com>
>  Ranjit Menon <ranjit.menon@intel.com>
> diff --git a/drivers/event/cnxk/cn20k_worker.h
> b/drivers/event/cnxk/cn20k_worker.h
> index 6442113e09..5723a6eabb 100644
> --- a/drivers/event/cnxk/cn20k_worker.h
> +++ b/drivers/event/cnxk/cn20k_worker.h
> @@ -48,7 +48,7 @@ cn20k_process_vwqe(uintptr_t vwqe, uint16_t port_id,
> const uint32_t flags, struc
>  {
>         uint64_t mbuf_init = 0x100010000ULL | RTE_PKTMBUF_HEADROOM;
>         struct cnxk_timesync_info *tstamp = ws->tstamp[port_id];
> -       uint8_t m_sz = sizeof(struct rte_mbuf);
> +       const uint32_t m_sz = sizeof(struct rte_mbuf);
>         void *lookup_mem = ws->lookup_mem;
>         uint64_t meta_aura = 0, laddr = 0;
>         uintptr_t lbase = ws->lmt_base;
> @@ -165,7 +165,7 @@ cn20k_process_vwqe(uintptr_t vwqe, uint16_t port_id,
> const uint32_t flags, struc
>  static __rte_always_inline void
>  cn20k_sso_hws_post_process(struct cn20k_sso_hws *ws, uint64_t *u64, const
> uint32_t flags)
>  {
> -       uint8_t m_sz = sizeof(struct rte_mbuf);
> +       const uint32_t m_sz = sizeof(struct rte_mbuf);
>         uintptr_t sa_base = 0;
>
>         u64[0] = (u64[0] & (0x3ull << 32)) << 6 | (u64[0] & (0x3FFull <<
> 36)) << 4 |
> diff --git a/drivers/net/cnxk/cn20k_rx.h b/drivers/net/cnxk/cn20k_rx.h
> index f8fa6de2b9..b544868c03 100644
> --- a/drivers/net/cnxk/cn20k_rx.h
> +++ b/drivers/net/cnxk/cn20k_rx.h
> @@ -702,7 +702,7 @@ cn20k_nix_recv_pkts(void *rx_queue, struct rte_mbuf
> **rx_pkts, uint16_t pkts, co
>         uint64_t mbuf_init = rxq->mbuf_initializer;
>         const void *lookup_mem = rxq->lookup_mem;
>         const uint64_t data_off = rxq->data_off;
> -       uint8_t m_sz = sizeof(struct rte_mbuf);
> +       const uint32_t m_sz = sizeof(struct rte_mbuf);
>         const uint64_t wdata = rxq->wdata;
>         const uint32_t qmask = rxq->qmask;
>         const uintptr_t desc = rxq->desc;
> @@ -815,7 +815,7 @@ cn20k_nix_flush_recv_pkts(void *rx_queue, struct
> rte_mbuf **rx_pkts, uint16_t pk
>         uint64_t mbuf_init = rxq->mbuf_initializer;
>         const void *lookup_mem = rxq->lookup_mem;
>         const uint64_t data_off = rxq->data_off;
> -       uint8_t m_sz = sizeof(struct rte_mbuf);
> +       const uint32_t m_sz = sizeof(struct rte_mbuf);
>         const uint64_t wdata = rxq->wdata;
>         const uint32_t qmask = rxq->qmask;
>         const uintptr_t desc = rxq->desc;
> --
> 2.35.6
>
>

[-- Attachment #2: Type: text/html, Size: 5851 bytes --]

RE: [PATCH 1/1] drivers: fix CN20K mbuf size truncation

[Morten Brørup]

[-- Attachment #1: Type: text/plain, Size: 4523 bytes --]

There where there already.

The patch only changes the size of some local variables.

 

Venlig hilsen / Kind regards,

-Morten Brørup

 

From: Stephen Hemminger [mailto:stephen@networkplumber.org] 
Sent: Wednesday, 9 September 2026 19.16
To: Randy L Tice
Cc: dev; stable; Thomas Monjalon; Pavan Nikhilesh; Shijith Thotton; Nithin Dabilpuram; Kiran Kumar K; Sunil Kumar Kori; Satha Rao; Harman Kalra; rbhansali@marvell.com
Subject: Re: [PATCH 1/1] drivers: fix CN20K mbuf size truncation

 

stop "cargo culting" use of always inline attribute. that attribute should only be used in special cases where code breaks compilation without it. it is not a go faster flag

 

On Wed, Sep 9, 2026, 09:06 Randy L Tice <rtice@cisco.com> wrote:

	CN20K inline security receive paths recover the packet mbuf by
	subtracting sizeof(struct rte_mbuf) from a pointer stored in
	completion metadata.
	
	The size is currently kept in a uint8_t local variable before
	that subtraction. This truncates the value when the mbuf structure
	grows beyond 255 bytes, and can recover the wrong mbuf address.
	
	Use a uint32_t local value for the mbuf byte size so larger mbuf
	layouts are handled correctly.
	
	Fixes: 5856f23129bb ("net/cnxk: support CN20K inline IPsec Rx")
	Fixes: edd0d5f3c299 ("event/cnxk: support CN20K inline IPsec Rx")
	Cc: stable@dpdk.org
	
	Signed-off-by: Randy L Tice <rtice@cisco.com>
	---
	 .mailmap                          | 1 +
	 drivers/event/cnxk/cn20k_worker.h | 4 ++--
	 drivers/net/cnxk/cn20k_rx.h       | 4 ++--
	 3 files changed, 5 insertions(+), 4 deletions(-)
	
	diff --git a/.mailmap b/.mailmap
	index fcb3d1bb3f..2a8b54ea23 100644
	--- a/.mailmap
	+++ b/.mailmap
	@@ -1379,6 +1379,7 @@ Rakesh Kudurumalla <rkudurumalla@marvell.com> <rkudurumalla@caviumnetworks.com>
	 Ralf Hoffmann <ralf.hoffmann@allegro-packets.com>
	 Rami Rosen <ramirose@gmail.com> <rami.rosen@intel.com>
	 Rami Rosen <ramirose@gmail.com> <roszenrami@gmail.com>
	+Randy L Tice <rtice@cisco.com>
	 Randy Schacher <stuart.schacher@broadcom.com>
	 Rani Sharoni <ranish@nvidia.com>
	 Ranjit Menon <ranjit.menon@intel.com>
	diff --git a/drivers/event/cnxk/cn20k_worker.h b/drivers/event/cnxk/cn20k_worker.h
	index 6442113e09..5723a6eabb 100644
	--- a/drivers/event/cnxk/cn20k_worker.h
	+++ b/drivers/event/cnxk/cn20k_worker.h
	@@ -48,7 +48,7 @@ cn20k_process_vwqe(uintptr_t vwqe, uint16_t port_id, const uint32_t flags, struc
	 {
	        uint64_t mbuf_init = 0x100010000ULL | RTE_PKTMBUF_HEADROOM;
	        struct cnxk_timesync_info *tstamp = ws->tstamp[port_id];
	-       uint8_t m_sz = sizeof(struct rte_mbuf);
	+       const uint32_t m_sz = sizeof(struct rte_mbuf);
	        void *lookup_mem = ws->lookup_mem;
	        uint64_t meta_aura = 0, laddr = 0;
	        uintptr_t lbase = ws->lmt_base;
	@@ -165,7 +165,7 @@ cn20k_process_vwqe(uintptr_t vwqe, uint16_t port_id, const uint32_t flags, struc
	 static __rte_always_inline void
	 cn20k_sso_hws_post_process(struct cn20k_sso_hws *ws, uint64_t *u64, const uint32_t flags)
	 {
	-       uint8_t m_sz = sizeof(struct rte_mbuf);
	+       const uint32_t m_sz = sizeof(struct rte_mbuf);
	        uintptr_t sa_base = 0;
	
	        u64[0] = (u64[0] & (0x3ull << 32)) << 6 | (u64[0] & (0x3FFull << 36)) << 4 |
	diff --git a/drivers/net/cnxk/cn20k_rx.h b/drivers/net/cnxk/cn20k_rx.h
	index f8fa6de2b9..b544868c03 100644
	--- a/drivers/net/cnxk/cn20k_rx.h
	+++ b/drivers/net/cnxk/cn20k_rx.h
	@@ -702,7 +702,7 @@ cn20k_nix_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t pkts, co
	        uint64_t mbuf_init = rxq->mbuf_initializer;
	        const void *lookup_mem = rxq->lookup_mem;
	        const uint64_t data_off = rxq->data_off;
	-       uint8_t m_sz = sizeof(struct rte_mbuf);
	+       const uint32_t m_sz = sizeof(struct rte_mbuf);
	        const uint64_t wdata = rxq->wdata;
	        const uint32_t qmask = rxq->qmask;
	        const uintptr_t desc = rxq->desc;
	@@ -815,7 +815,7 @@ cn20k_nix_flush_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t pk
	        uint64_t mbuf_init = rxq->mbuf_initializer;
	        const void *lookup_mem = rxq->lookup_mem;
	        const uint64_t data_off = rxq->data_off;
	-       uint8_t m_sz = sizeof(struct rte_mbuf);
	+       const uint32_t m_sz = sizeof(struct rte_mbuf);
	        const uint64_t wdata = rxq->wdata;
	        const uint32_t qmask = rxq->qmask;
	        const uintptr_t desc = rxq->desc;
	-- 
	2.35.6


[-- Attachment #2: Type: text/html, Size: 9403 bytes --]

Re: [PATCH 1/1] drivers: fix CN20K mbuf size truncation

[Stephen Hemminger]

On Wed, 9 Sep 2026 20:18:02 +0200
Morten Brørup <mb@smartsharesystems.com> wrote:

> There where there already.
> 
> The patch only changes the size of some local variables.


Agreed, I am going to do a tree wide fix of this.