[PATCH] net/memif: fix descriptor flags corruption in multi-segment TX

[Sriram Yagnaraman]

The memif TX path was using |= to set descriptor flags, which could
leave stale flag bits from previous ring iterations. This caused
descriptor corruption when the ring wrapped around, leading to
malformed packet chains and RX failures.

Initialize d0->flags to 0 before setting MEMIF_DESC_FLAG_NEXT to
ensure clean descriptor state on each transmission.

Fixes: 43b815d88188 ("net/memif: support zero-copy slave")
Cc: stable at dpdk.org

Signed-off-by: Sriram Yagnaraman <sriram.yagnaraman at ericsson.com>
---
 drivers/net/memif/rte_eth_memif.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/net/memif/rte_eth_memif.c b/drivers/net/memif/rte_eth_memif.c
index 8d7060cd7c..effcee3721 100644
--- a/drivers/net/memif/rte_eth_memif.c
+++ b/drivers/net/memif/rte_eth_memif.c
@@ -714,6 +714,7 @@ eth_memif_tx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
 
 next_in_chain1:
 			d0 = &ring->desc[slot & mask];
+			d0->flags = 0;
 			cp_len = rte_pktmbuf_data_len(mbuf);
 
 			rte_memcpy((uint8_t *)memif_get_buffer(proc_private, d0),
@@ -726,7 +727,7 @@ eth_memif_tx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
 
 			if (--nb_segs > 0) {
 				if (n_free) {
-					d0->flags |= MEMIF_DESC_FLAG_NEXT;
+					d0->flags = MEMIF_DESC_FLAG_NEXT;
 					mbuf = mbuf->next;
 					goto next_in_chain1;
 				} else {
@@ -747,6 +748,7 @@ eth_memif_tx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
 
 			saved_slot = slot;
 			d0 = &ring->desc[slot & mask];
+			d0->flags = 0;
 			dst_off = 0;
 			dst_len = (type == MEMIF_RING_C2S) ?
 				pmd->run.pkt_buffer_size : d0->length;
@@ -760,12 +762,12 @@ eth_memif_tx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
 					if (n_free) {
 						slot++;
 						n_free--;
-						d0->flags |= MEMIF_DESC_FLAG_NEXT;
+						d0->flags = MEMIF_DESC_FLAG_NEXT;
 						d0 = &ring->desc[slot & mask];
+						d0->flags = 0;
 						dst_off = 0;
 						dst_len = (type == MEMIF_RING_C2S) ?
 						    pmd->run.pkt_buffer_size : d0->length;
-						d0->flags = 0;
 					} else {
 						slot = saved_slot;
 						goto no_free_slots;
-- 
2.43.7