* [PATCH 0/1] Fix CN20K mbuf size truncation @ 2026-09-09 16:06 Randy L Tice 2026-09-09 16:06 ` [PATCH 1/1] drivers: fix " Randy L Tice 0 siblings, 1 reply; 5+ messages in thread From: Randy L Tice @ 2026-09-09 16:06 UTC (permalink / raw) To: dev Cc: stable, thomas, pbhagavatula, sthotton, ndabilpuram, kirankumark, skori, skoteshwar, hkalra, rbhansali, Randy L Tice This small fix prepares the CN20K inline security receive paths for mbuf layouts larger than 255 bytes. The affected code recovers a packet mbuf by subtracting the size of struct rte_mbuf from a pointer stored in completion metadata. Keeping that size in an 8-bit local variable makes the recovery sensitive to future mbuf layout growth. The patch widens the local size variable without changing the surrounding fast-path logic. The issue was found while preparing an unrelated mbuf layout extension. Randy L Tice (1): drivers: fix CN20K mbuf size truncation .mailmap | 1 + drivers/event/cnxk/cn20k_worker.h | 4 ++-- drivers/net/cnxk/cn20k_rx.h | 4 ++-- 3 files changed, 5 insertions(+), 4 deletions(-) -- 2.35.6 ^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH 1/1] drivers: fix CN20K mbuf size truncation 2026-09-09 16:06 [PATCH 0/1] Fix CN20K mbuf size truncation Randy L Tice @ 2026-09-09 16:06 ` Randy L Tice 2026-09-09 17:16 ` Stephen Hemminger 0 siblings, 1 reply; 5+ messages in thread From: Randy L Tice @ 2026-09-09 16:06 UTC (permalink / raw) To: dev Cc: stable, thomas, pbhagavatula, sthotton, ndabilpuram, kirankumark, skori, skoteshwar, hkalra, rbhansali, Randy L Tice CN20K inline security receive paths recover the packet mbuf by subtracting sizeof(struct rte_mbuf) from a pointer stored in completion metadata. The size is currently kept in a uint8_t local variable before that subtraction. This truncates the value when the mbuf structure grows beyond 255 bytes, and can recover the wrong mbuf address. Use a uint32_t local value for the mbuf byte size so larger mbuf layouts are handled correctly. Fixes: 5856f23129bb ("net/cnxk: support CN20K inline IPsec Rx") Fixes: edd0d5f3c299 ("event/cnxk: support CN20K inline IPsec Rx") Cc: stable@dpdk.org Signed-off-by: Randy L Tice <rtice@cisco.com> --- .mailmap | 1 + drivers/event/cnxk/cn20k_worker.h | 4 ++-- drivers/net/cnxk/cn20k_rx.h | 4 ++-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/.mailmap b/.mailmap index fcb3d1bb3f..2a8b54ea23 100644 --- a/.mailmap +++ b/.mailmap @@ -1379,6 +1379,7 @@ Rakesh Kudurumalla <rkudurumalla@marvell.com> <rkudurumalla@caviumnetworks.com> Ralf Hoffmann <ralf.hoffmann@allegro-packets.com> Rami Rosen <ramirose@gmail.com> <rami.rosen@intel.com> Rami Rosen <ramirose@gmail.com> <roszenrami@gmail.com> +Randy L Tice <rtice@cisco.com> Randy Schacher <stuart.schacher@broadcom.com> Rani Sharoni <ranish@nvidia.com> Ranjit Menon <ranjit.menon@intel.com> diff --git a/drivers/event/cnxk/cn20k_worker.h b/drivers/event/cnxk/cn20k_worker.h index 6442113e09..5723a6eabb 100644 --- a/drivers/event/cnxk/cn20k_worker.h +++ b/drivers/event/cnxk/cn20k_worker.h @@ -48,7 +48,7 @@ cn20k_process_vwqe(uintptr_t vwqe, uint16_t port_id, const uint32_t flags, struc { uint64_t mbuf_init = 0x100010000ULL | RTE_PKTMBUF_HEADROOM; struct cnxk_timesync_info *tstamp = ws->tstamp[port_id]; - uint8_t m_sz = sizeof(struct rte_mbuf); + const uint32_t m_sz = sizeof(struct rte_mbuf); void *lookup_mem = ws->lookup_mem; uint64_t meta_aura = 0, laddr = 0; uintptr_t lbase = ws->lmt_base; @@ -165,7 +165,7 @@ cn20k_process_vwqe(uintptr_t vwqe, uint16_t port_id, const uint32_t flags, struc static __rte_always_inline void cn20k_sso_hws_post_process(struct cn20k_sso_hws *ws, uint64_t *u64, const uint32_t flags) { - uint8_t m_sz = sizeof(struct rte_mbuf); + const uint32_t m_sz = sizeof(struct rte_mbuf); uintptr_t sa_base = 0; u64[0] = (u64[0] & (0x3ull << 32)) << 6 | (u64[0] & (0x3FFull << 36)) << 4 | diff --git a/drivers/net/cnxk/cn20k_rx.h b/drivers/net/cnxk/cn20k_rx.h index f8fa6de2b9..b544868c03 100644 --- a/drivers/net/cnxk/cn20k_rx.h +++ b/drivers/net/cnxk/cn20k_rx.h @@ -702,7 +702,7 @@ cn20k_nix_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t pkts, co uint64_t mbuf_init = rxq->mbuf_initializer; const void *lookup_mem = rxq->lookup_mem; const uint64_t data_off = rxq->data_off; - uint8_t m_sz = sizeof(struct rte_mbuf); + const uint32_t m_sz = sizeof(struct rte_mbuf); const uint64_t wdata = rxq->wdata; const uint32_t qmask = rxq->qmask; const uintptr_t desc = rxq->desc; @@ -815,7 +815,7 @@ cn20k_nix_flush_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t pk uint64_t mbuf_init = rxq->mbuf_initializer; const void *lookup_mem = rxq->lookup_mem; const uint64_t data_off = rxq->data_off; - uint8_t m_sz = sizeof(struct rte_mbuf); + const uint32_t m_sz = sizeof(struct rte_mbuf); const uint64_t wdata = rxq->wdata; const uint32_t qmask = rxq->qmask; const uintptr_t desc = rxq->desc; -- 2.35.6 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH 1/1] drivers: fix CN20K mbuf size truncation 2026-09-09 16:06 ` [PATCH 1/1] drivers: fix " Randy L Tice @ 2026-09-09 17:16 ` Stephen Hemminger 2026-09-09 18:18 ` Morten Brørup 0 siblings, 1 reply; 5+ messages in thread From: Stephen Hemminger @ 2026-09-09 17:16 UTC (permalink / raw) To: Randy L Tice Cc: dev, stable, Thomas Monjalon, Pavan Nikhilesh, Shijith Thotton, Nithin Dabilpuram, Kiran Kumar K, Sunil Kumar Kori, Satha Rao, Harman Kalra, rbhansali [-- Attachment #1: Type: text/plain, Size: 4012 bytes --] stop "cargo culting" use of always inline attribute. that attribute should only be used in special cases where code breaks compilation without it. it is not a go faster flag On Wed, Sep 9, 2026, 09:06 Randy L Tice <rtice@cisco.com> wrote: > CN20K inline security receive paths recover the packet mbuf by > subtracting sizeof(struct rte_mbuf) from a pointer stored in > completion metadata. > > The size is currently kept in a uint8_t local variable before > that subtraction. This truncates the value when the mbuf structure > grows beyond 255 bytes, and can recover the wrong mbuf address. > > Use a uint32_t local value for the mbuf byte size so larger mbuf > layouts are handled correctly. > > Fixes: 5856f23129bb ("net/cnxk: support CN20K inline IPsec Rx") > Fixes: edd0d5f3c299 ("event/cnxk: support CN20K inline IPsec Rx") > Cc: stable@dpdk.org > > Signed-off-by: Randy L Tice <rtice@cisco.com> > --- > .mailmap | 1 + > drivers/event/cnxk/cn20k_worker.h | 4 ++-- > drivers/net/cnxk/cn20k_rx.h | 4 ++-- > 3 files changed, 5 insertions(+), 4 deletions(-) > > diff --git a/.mailmap b/.mailmap > index fcb3d1bb3f..2a8b54ea23 100644 > --- a/.mailmap > +++ b/.mailmap > @@ -1379,6 +1379,7 @@ Rakesh Kudurumalla <rkudurumalla@marvell.com> < > rkudurumalla@caviumnetworks.com> > Ralf Hoffmann <ralf.hoffmann@allegro-packets.com> > Rami Rosen <ramirose@gmail.com> <rami.rosen@intel.com> > Rami Rosen <ramirose@gmail.com> <roszenrami@gmail.com> > +Randy L Tice <rtice@cisco.com> > Randy Schacher <stuart.schacher@broadcom.com> > Rani Sharoni <ranish@nvidia.com> > Ranjit Menon <ranjit.menon@intel.com> > diff --git a/drivers/event/cnxk/cn20k_worker.h > b/drivers/event/cnxk/cn20k_worker.h > index 6442113e09..5723a6eabb 100644 > --- a/drivers/event/cnxk/cn20k_worker.h > +++ b/drivers/event/cnxk/cn20k_worker.h > @@ -48,7 +48,7 @@ cn20k_process_vwqe(uintptr_t vwqe, uint16_t port_id, > const uint32_t flags, struc > { > uint64_t mbuf_init = 0x100010000ULL | RTE_PKTMBUF_HEADROOM; > struct cnxk_timesync_info *tstamp = ws->tstamp[port_id]; > - uint8_t m_sz = sizeof(struct rte_mbuf); > + const uint32_t m_sz = sizeof(struct rte_mbuf); > void *lookup_mem = ws->lookup_mem; > uint64_t meta_aura = 0, laddr = 0; > uintptr_t lbase = ws->lmt_base; > @@ -165,7 +165,7 @@ cn20k_process_vwqe(uintptr_t vwqe, uint16_t port_id, > const uint32_t flags, struc > static __rte_always_inline void > cn20k_sso_hws_post_process(struct cn20k_sso_hws *ws, uint64_t *u64, const > uint32_t flags) > { > - uint8_t m_sz = sizeof(struct rte_mbuf); > + const uint32_t m_sz = sizeof(struct rte_mbuf); > uintptr_t sa_base = 0; > > u64[0] = (u64[0] & (0x3ull << 32)) << 6 | (u64[0] & (0x3FFull << > 36)) << 4 | > diff --git a/drivers/net/cnxk/cn20k_rx.h b/drivers/net/cnxk/cn20k_rx.h > index f8fa6de2b9..b544868c03 100644 > --- a/drivers/net/cnxk/cn20k_rx.h > +++ b/drivers/net/cnxk/cn20k_rx.h > @@ -702,7 +702,7 @@ cn20k_nix_recv_pkts(void *rx_queue, struct rte_mbuf > **rx_pkts, uint16_t pkts, co > uint64_t mbuf_init = rxq->mbuf_initializer; > const void *lookup_mem = rxq->lookup_mem; > const uint64_t data_off = rxq->data_off; > - uint8_t m_sz = sizeof(struct rte_mbuf); > + const uint32_t m_sz = sizeof(struct rte_mbuf); > const uint64_t wdata = rxq->wdata; > const uint32_t qmask = rxq->qmask; > const uintptr_t desc = rxq->desc; > @@ -815,7 +815,7 @@ cn20k_nix_flush_recv_pkts(void *rx_queue, struct > rte_mbuf **rx_pkts, uint16_t pk > uint64_t mbuf_init = rxq->mbuf_initializer; > const void *lookup_mem = rxq->lookup_mem; > const uint64_t data_off = rxq->data_off; > - uint8_t m_sz = sizeof(struct rte_mbuf); > + const uint32_t m_sz = sizeof(struct rte_mbuf); > const uint64_t wdata = rxq->wdata; > const uint32_t qmask = rxq->qmask; > const uintptr_t desc = rxq->desc; > -- > 2.35.6 > > [-- Attachment #2: Type: text/html, Size: 5851 bytes --] ^ permalink raw reply [flat|nested] 5+ messages in thread
* RE: [PATCH 1/1] drivers: fix CN20K mbuf size truncation 2026-09-09 17:16 ` Stephen Hemminger @ 2026-09-09 18:18 ` Morten Brørup 2026-09-09 20:42 ` Stephen Hemminger 0 siblings, 1 reply; 5+ messages in thread From: Morten Brørup @ 2026-09-09 18:18 UTC (permalink / raw) To: Stephen Hemminger, Randy L Tice Cc: dev, stable, Thomas Monjalon, Pavan Nikhilesh, Shijith Thotton, Nithin Dabilpuram, Kiran Kumar K, Sunil Kumar Kori, Satha Rao, Harman Kalra, rbhansali [-- Attachment #1: Type: text/plain, Size: 4523 bytes --] There where there already. The patch only changes the size of some local variables. Venlig hilsen / Kind regards, -Morten Brørup From: Stephen Hemminger [mailto:stephen@networkplumber.org] Sent: Wednesday, 9 September 2026 19.16 To: Randy L Tice Cc: dev; stable; Thomas Monjalon; Pavan Nikhilesh; Shijith Thotton; Nithin Dabilpuram; Kiran Kumar K; Sunil Kumar Kori; Satha Rao; Harman Kalra; rbhansali@marvell.com Subject: Re: [PATCH 1/1] drivers: fix CN20K mbuf size truncation stop "cargo culting" use of always inline attribute. that attribute should only be used in special cases where code breaks compilation without it. it is not a go faster flag On Wed, Sep 9, 2026, 09:06 Randy L Tice <rtice@cisco.com> wrote: CN20K inline security receive paths recover the packet mbuf by subtracting sizeof(struct rte_mbuf) from a pointer stored in completion metadata. The size is currently kept in a uint8_t local variable before that subtraction. This truncates the value when the mbuf structure grows beyond 255 bytes, and can recover the wrong mbuf address. Use a uint32_t local value for the mbuf byte size so larger mbuf layouts are handled correctly. Fixes: 5856f23129bb ("net/cnxk: support CN20K inline IPsec Rx") Fixes: edd0d5f3c299 ("event/cnxk: support CN20K inline IPsec Rx") Cc: stable@dpdk.org Signed-off-by: Randy L Tice <rtice@cisco.com> --- .mailmap | 1 + drivers/event/cnxk/cn20k_worker.h | 4 ++-- drivers/net/cnxk/cn20k_rx.h | 4 ++-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/.mailmap b/.mailmap index fcb3d1bb3f..2a8b54ea23 100644 --- a/.mailmap +++ b/.mailmap @@ -1379,6 +1379,7 @@ Rakesh Kudurumalla <rkudurumalla@marvell.com> <rkudurumalla@caviumnetworks.com> Ralf Hoffmann <ralf.hoffmann@allegro-packets.com> Rami Rosen <ramirose@gmail.com> <rami.rosen@intel.com> Rami Rosen <ramirose@gmail.com> <roszenrami@gmail.com> +Randy L Tice <rtice@cisco.com> Randy Schacher <stuart.schacher@broadcom.com> Rani Sharoni <ranish@nvidia.com> Ranjit Menon <ranjit.menon@intel.com> diff --git a/drivers/event/cnxk/cn20k_worker.h b/drivers/event/cnxk/cn20k_worker.h index 6442113e09..5723a6eabb 100644 --- a/drivers/event/cnxk/cn20k_worker.h +++ b/drivers/event/cnxk/cn20k_worker.h @@ -48,7 +48,7 @@ cn20k_process_vwqe(uintptr_t vwqe, uint16_t port_id, const uint32_t flags, struc { uint64_t mbuf_init = 0x100010000ULL | RTE_PKTMBUF_HEADROOM; struct cnxk_timesync_info *tstamp = ws->tstamp[port_id]; - uint8_t m_sz = sizeof(struct rte_mbuf); + const uint32_t m_sz = sizeof(struct rte_mbuf); void *lookup_mem = ws->lookup_mem; uint64_t meta_aura = 0, laddr = 0; uintptr_t lbase = ws->lmt_base; @@ -165,7 +165,7 @@ cn20k_process_vwqe(uintptr_t vwqe, uint16_t port_id, const uint32_t flags, struc static __rte_always_inline void cn20k_sso_hws_post_process(struct cn20k_sso_hws *ws, uint64_t *u64, const uint32_t flags) { - uint8_t m_sz = sizeof(struct rte_mbuf); + const uint32_t m_sz = sizeof(struct rte_mbuf); uintptr_t sa_base = 0; u64[0] = (u64[0] & (0x3ull << 32)) << 6 | (u64[0] & (0x3FFull << 36)) << 4 | diff --git a/drivers/net/cnxk/cn20k_rx.h b/drivers/net/cnxk/cn20k_rx.h index f8fa6de2b9..b544868c03 100644 --- a/drivers/net/cnxk/cn20k_rx.h +++ b/drivers/net/cnxk/cn20k_rx.h @@ -702,7 +702,7 @@ cn20k_nix_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t pkts, co uint64_t mbuf_init = rxq->mbuf_initializer; const void *lookup_mem = rxq->lookup_mem; const uint64_t data_off = rxq->data_off; - uint8_t m_sz = sizeof(struct rte_mbuf); + const uint32_t m_sz = sizeof(struct rte_mbuf); const uint64_t wdata = rxq->wdata; const uint32_t qmask = rxq->qmask; const uintptr_t desc = rxq->desc; @@ -815,7 +815,7 @@ cn20k_nix_flush_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t pk uint64_t mbuf_init = rxq->mbuf_initializer; const void *lookup_mem = rxq->lookup_mem; const uint64_t data_off = rxq->data_off; - uint8_t m_sz = sizeof(struct rte_mbuf); + const uint32_t m_sz = sizeof(struct rte_mbuf); const uint64_t wdata = rxq->wdata; const uint32_t qmask = rxq->qmask; const uintptr_t desc = rxq->desc; -- 2.35.6 [-- Attachment #2: Type: text/html, Size: 9403 bytes --] ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH 1/1] drivers: fix CN20K mbuf size truncation 2026-09-09 18:18 ` Morten Brørup @ 2026-09-09 20:42 ` Stephen Hemminger 0 siblings, 0 replies; 5+ messages in thread From: Stephen Hemminger @ 2026-09-09 20:42 UTC (permalink / raw) To: Morten Brørup Cc: Randy L Tice, dev, stable, Thomas Monjalon, Pavan Nikhilesh, Shijith Thotton, Nithin Dabilpuram, Kiran Kumar K, Sunil Kumar Kori, Satha Rao, Harman Kalra, rbhansali On Wed, 9 Sep 2026 20:18:02 +0200 Morten Brørup <mb@smartsharesystems.com> wrote: > There where there already. > > The patch only changes the size of some local variables. Agreed, I am going to do a tree wide fix of this. ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-09-09 20:43 UTC | newest] Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-09-09 16:06 [PATCH 0/1] Fix CN20K mbuf size truncation Randy L Tice 2026-09-09 16:06 ` [PATCH 1/1] drivers: fix " Randy L Tice 2026-09-09 17:16 ` Stephen Hemminger 2026-09-09 18:18 ` Morten Brørup 2026-09-09 20:42 ` Stephen Hemminger
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox