[PATCH v2] net/memif: fix multi-segment Rx corruption

[Stephen Hemminger]

On Tue, 24 Mar 2026 17:14:36 +0100
Sriram Yagnaraman <sriram.yagnaraman at ericsson.com> wrote:

> Fix dst_off being reset per-descriptor instead of per-packet in the Rx
> slow path. When processing chained descriptors (MEMIF_DESC_FLAG_NEXT),
> goto next_slot2 reset dst_off to 0, overwriting the beginning of the
> current mbuf with data from subsequent descriptors. Move dst_off
> initialization before the next_slot2 label so it is only reset once
> per packet.
> 
> Add boundary check in both Rx paths before processing next segment.
> If MEMIF_DESC_FLAG_NEXT is set but n_slots is 0, free the incomplete
> mbuf chain and exit gracefully to prevent reading beyond available
> descriptors.
> 
> Bugzilla ID: 1609
> Fixes: aa17df860891 ("net/memif: add a Rx fast path")
> Cc: stable at dpdk.org
> 
> Reported-by: Mike Bly <bly454 at gmail.com>
> Signed-off-by: Sriram Yagnaraman <sriram.yagnaraman at ericsson.com>
> ---

This version go clean review from AI.
Applied to next-net