[PATCH] net/intel/common: avoid field pointer arithmetic

[PATCH] net/intel/common: avoid field pointer arithmetic

[Artem Novikov]

The Rx rearm failure path assigns fake mbufs through rxp, but rxp is the
address of the mbuf field in a single software ring entry.

Use the software ring array for indexed access so pointer arithmetic is
done on struct ci_rx_entry instead of on the address of a field.

Fixes: 773cbaf2ad38 ("net/intel: avoid allocating from mempool directly")
Cc: stable@dpdk.org
Cc: bruce.richardson@intel.com

Signed-off-by: Artem Novikov <naa@amicon.ru>
---
 drivers/net/intel/common/rx_vec_x86.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/intel/common/rx_vec_x86.h b/drivers/net/intel/common/rx_vec_x86.h
index 8d497e7196..9670a21fa4 100644
--- a/drivers/net/intel/common/rx_vec_x86.h
+++ b/drivers/net/intel/common/rx_vec_x86.h
@@ -33,7 +33,7 @@ _ci_rxq_rearm_get_bufs(struct ci_rx_queue *rxq)
 			const __m128i zero = _mm_setzero_si128();
 
 			for (i = 0; i < CI_VPMD_DESCS_PER_LOOP; i++) {
-				rxp[i] = &rxq->fake_mbuf;
+				rxq->sw_ring[rxq->rxrearm_start + i].mbuf = &rxq->fake_mbuf;
 				_mm_store_si128(RTE_CAST_PTR(__m128i *, &rxdp[i]), zero);
 			}
 		}
-- 
2.43.0

Re: [PATCH] net/intel/common: avoid field pointer arithmetic

[Bruce Richardson]

On Mon, Sep 14, 2026 at 01:04:33PM +0300, Artem Novikov wrote:
> The Rx rearm failure path assigns fake mbufs through rxp, but rxp is the
> address of the mbuf field in a single software ring entry.
> 
> Use the software ring array for indexed access so pointer arithmetic is
> done on struct ci_rx_entry instead of on the address of a field.
> 
> Fixes: 773cbaf2ad38 ("net/intel: avoid allocating from mempool directly")
> Cc: stable@dpdk.org
> Cc: bruce.richardson@intel.com
> 
> Signed-off-by: Artem Novikov <naa@amicon.ru>
> ---
>  drivers/net/intel/common/rx_vec_x86.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/intel/common/rx_vec_x86.h b/drivers/net/intel/common/rx_vec_x86.h
> index 8d497e7196..9670a21fa4 100644
> --- a/drivers/net/intel/common/rx_vec_x86.h
> +++ b/drivers/net/intel/common/rx_vec_x86.h
> @@ -33,7 +33,7 @@ _ci_rxq_rearm_get_bufs(struct ci_rx_queue *rxq)
>  			const __m128i zero = _mm_setzero_si128();
>  
>  			for (i = 0; i < CI_VPMD_DESCS_PER_LOOP; i++) {
> -				rxp[i] = &rxq->fake_mbuf;
> +				rxq->sw_ring[rxq->rxrearm_start + i].mbuf = &rxq->fake_mbuf;
>  				_mm_store_si128(RTE_CAST_PTR(__m128i *, &rxdp[i]), zero);
>  			}

The existing code here is correct, because the SW ring elements are just 1
mbuf in themselves. While the change you propose does make things "more
correct" from a theoretical viewpoint, I would prefer to keep the existing
code because it means that the assignments to both HW and SW ring are done
similarly, by indexing into rxdp[i] and rxp[i].

/Bruce

>  		}
> -- 
> 2.43.0
> 

Re: [PATCH] net/intel/common: avoid field pointer arithmetic

[Bruce Richardson]

On Mon, Sep 14, 2026 at 12:23:58PM +0100, Bruce Richardson wrote:
> On Mon, Sep 14, 2026 at 01:04:33PM +0300, Artem Novikov wrote:
> > The Rx rearm failure path assigns fake mbufs through rxp, but rxp is the
> > address of the mbuf field in a single software ring entry.
> > 
> > Use the software ring array for indexed access so pointer arithmetic is
> > done on struct ci_rx_entry instead of on the address of a field.
> > 
> > Fixes: 773cbaf2ad38 ("net/intel: avoid allocating from mempool directly")
> > Cc: stable@dpdk.org
> > Cc: bruce.richardson@intel.com
> > 
> > Signed-off-by: Artem Novikov <naa@amicon.ru>
> > ---
> >  drivers/net/intel/common/rx_vec_x86.h | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/drivers/net/intel/common/rx_vec_x86.h b/drivers/net/intel/common/rx_vec_x86.h
> > index 8d497e7196..9670a21fa4 100644
> > --- a/drivers/net/intel/common/rx_vec_x86.h
> > +++ b/drivers/net/intel/common/rx_vec_x86.h
> > @@ -33,7 +33,7 @@ _ci_rxq_rearm_get_bufs(struct ci_rx_queue *rxq)
> >  			const __m128i zero = _mm_setzero_si128();
> >  
> >  			for (i = 0; i < CI_VPMD_DESCS_PER_LOOP; i++) {
> > -				rxp[i] = &rxq->fake_mbuf;
> > +				rxq->sw_ring[rxq->rxrearm_start + i].mbuf = &rxq->fake_mbuf;
> >  				_mm_store_si128(RTE_CAST_PTR(__m128i *, &rxdp[i]), zero);
> >  			}
> 
> The existing code here is correct, because the SW ring elements are just 1
> mbuf in themselves. While the change you propose does make things "more
> correct" from a theoretical viewpoint, I would prefer to keep the existing
> code because it means that the assignments to both HW and SW ring are done
> similarly, by indexing into rxdp[i] and rxp[i].
> 
> /Bruce
>
Marking as rejected in patchwork