[PATCH] net/mlx5: restore fake mbuf guards on Rx replenish failure

[Dariusz Sosnowski]

> -----Original Message-----
> From: Pavel Ivashchenko <pivashchenko at nfware.com>
> Sent: Thursday, September 24, 2026 9:13 PM
> To: dev at dpdk.org
> Cc: stable at dpdk.org; Dariusz Sosnowski <dsosnowski at nvidia.com>; Slava
> Ovsiienko <viacheslavo at nvidia.com>; Bing Zhao <bingz at nvidia.com>; Ori Kam
> <orika at nvidia.com>; Suanming Mou <suanmingm at nvidia.com>; Matan Azrad
> <matan at nvidia.com>; mb at smartsharesystems.com;
> andrew.rybchenko at oktetlabs.ru; NBU-Contact-Thomas Monjalon (EXTERNAL)
> <thomas at monjalon.net>; mmamatov at nfware.com; Pavel Ivashchenko
> <pivashchenko at nfware.com>
> Subject: [PATCH] net/mlx5: restore fake mbuf guards on Rx replenish failure
> 
> From: Mikhail Mamatov <mmamatov at nfware.com>
> 
> Vectorized Rx keeps MLX5_VPMD_DESCS_PER_LOOP entries of elts[] pointing to
> rxq->fake_mbuf after the allocated mbufs. Both rxq_cq_process_v() and
> rxq_cq_decompress_v() write mbuf metadata for full SIMD groups. In particular,
> CQE decompression may write through these guard entries when processing a
> partial trailing group.
> 
> Both mlx5_rx_replenish_bulk_mbuf() and
> mlx5_rx_mprq_replenish_bulk_mbuf() pass the guard slots directly to
> rte_mempool_get_bulk(). Since a2833ecc5ea4, the mempool get path copies
> available objects from the per-lcore cache to the output array before fetching
> the remaining objects from the backend. If the cache contains fewer objects
> than requested and the backend cannot supply the rest, the operation restores
> the cache length but leaves the output array partially overwritten.
> 
> Returning from replenishment without restoring the guards therefore leaves
> them pointing to mbufs still owned by the mempool. A later allocation can hand
> these mbufs to the application, after which CQE decompression may corrupt
> their metadata through the stale pointers.
> 
> Restore the four fake mbuf pointers on allocation failure in both the regular and
> MPRQ vector Rx paths. The producer index does not advance on failure, so
> restoring the guards at the original allocation position is sufficient. This adds
> work only on the allocation failure path.
> 
> Fixes: a2833ecc5ea4 ("mempool: fix get objects from mempool with cache")
> Cc: stable at dpdk.org
> 
> Signed-off-by: Mikhail Mamatov <mmamatov at nfware.com>
> Signed-off-by: Pavel Ivashchenko <pivashchenko at nfware.com>

Acked-by: Dariusz Sosnowski <dsosnowski at nvidia.com>

Thank you for the contribution

Best regards,
Dariusz Sosnowski