[PATCH 1/1] drivers: fix CN20K mbuf size truncation

[Jerin Jacob]

On Tue, Sep 22, 2026 at 11:39 AM Nithin Dabilpuram
<nithind1988 at gmail.com> wrote:
>
> Acked-by: Nithin Dabilpuram <ndabilpuram at marvell.com>


Applied to dpdk-next-net-mrvl/for-main. Thanks

>
> On Wed, Sep 9, 2026 at 9:37 PM Randy L Tice <rtice at cisco.com> wrote:
> >
> > CN20K inline security receive paths recover the packet mbuf by
> > subtracting sizeof(struct rte_mbuf) from a pointer stored in
> > completion metadata.
> >
> > The size is currently kept in a uint8_t local variable before
> > that subtraction. This truncates the value when the mbuf structure
> > grows beyond 255 bytes, and can recover the wrong mbuf address.
> >
> > Use a uint32_t local value for the mbuf byte size so larger mbuf
> > layouts are handled correctly.
> >
> > Fixes: 5856f23129bb ("net/cnxk: support CN20K inline IPsec Rx")
> > Fixes: edd0d5f3c299 ("event/cnxk: support CN20K inline IPsec Rx")
> > Cc: stable at dpdk.org
> >
> > Signed-off-by: Randy L Tice <rtice at cisco.com>
> > ---
> >  .mailmap                          | 1 +
> >  drivers/event/cnxk/cn20k_worker.h | 4 ++--
> >  drivers/net/cnxk/cn20k_rx.h       | 4 ++--
> >  3 files changed, 5 insertions(+), 4 deletions(-)
> >
> > diff --git a/.mailmap b/.mailmap
> > index fcb3d1bb3f..2a8b54ea23 100644
> > --- a/.mailmap
> > +++ b/.mailmap
> > @@ -1379,6 +1379,7 @@ Rakesh Kudurumalla <rkudurumalla at marvell.com> <rkudurumalla at caviumnetworks.com>
> >  Ralf Hoffmann <ralf.hoffmann at allegro-packets.com>
> >  Rami Rosen <ramirose at gmail.com> <rami.rosen at intel.com>
> >  Rami Rosen <ramirose at gmail.com> <roszenrami at gmail.com>
> > +Randy L Tice <rtice at cisco.com>
> >  Randy Schacher <stuart.schacher at broadcom.com>
> >  Rani Sharoni <ranish at nvidia.com>
> >  Ranjit Menon <ranjit.menon at intel.com>
> > diff --git a/drivers/event/cnxk/cn20k_worker.h b/drivers/event/cnxk/cn20k_worker.h
> > index 6442113e09..5723a6eabb 100644
> > --- a/drivers/event/cnxk/cn20k_worker.h
> > +++ b/drivers/event/cnxk/cn20k_worker.h
> > @@ -48,7 +48,7 @@ cn20k_process_vwqe(uintptr_t vwqe, uint16_t port_id, const uint32_t flags, struc
> >  {
> >         uint64_t mbuf_init = 0x100010000ULL | RTE_PKTMBUF_HEADROOM;
> >         struct cnxk_timesync_info *tstamp = ws->tstamp[port_id];
> > -       uint8_t m_sz = sizeof(struct rte_mbuf);
> > +       const uint32_t m_sz = sizeof(struct rte_mbuf);
> >         void *lookup_mem = ws->lookup_mem;
> >         uint64_t meta_aura = 0, laddr = 0;
> >         uintptr_t lbase = ws->lmt_base;
> > @@ -165,7 +165,7 @@ cn20k_process_vwqe(uintptr_t vwqe, uint16_t port_id, const uint32_t flags, struc
> >  static __rte_always_inline void
> >  cn20k_sso_hws_post_process(struct cn20k_sso_hws *ws, uint64_t *u64, const uint32_t flags)
> >  {
> > -       uint8_t m_sz = sizeof(struct rte_mbuf);
> > +       const uint32_t m_sz = sizeof(struct rte_mbuf);
> >         uintptr_t sa_base = 0;
> >
> >         u64[0] = (u64[0] & (0x3ull << 32)) << 6 | (u64[0] & (0x3FFull << 36)) << 4 |
> > diff --git a/drivers/net/cnxk/cn20k_rx.h b/drivers/net/cnxk/cn20k_rx.h
> > index f8fa6de2b9..b544868c03 100644
> > --- a/drivers/net/cnxk/cn20k_rx.h
> > +++ b/drivers/net/cnxk/cn20k_rx.h
> > @@ -702,7 +702,7 @@ cn20k_nix_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t pkts, co
> >         uint64_t mbuf_init = rxq->mbuf_initializer;
> >         const void *lookup_mem = rxq->lookup_mem;
> >         const uint64_t data_off = rxq->data_off;
> > -       uint8_t m_sz = sizeof(struct rte_mbuf);
> > +       const uint32_t m_sz = sizeof(struct rte_mbuf);
> >         const uint64_t wdata = rxq->wdata;
> >         const uint32_t qmask = rxq->qmask;
> >         const uintptr_t desc = rxq->desc;
> > @@ -815,7 +815,7 @@ cn20k_nix_flush_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t pk
> >         uint64_t mbuf_init = rxq->mbuf_initializer;
> >         const void *lookup_mem = rxq->lookup_mem;
> >         const uint64_t data_off = rxq->data_off;
> > -       uint8_t m_sz = sizeof(struct rte_mbuf);
> > +       const uint32_t m_sz = sizeof(struct rte_mbuf);
> >         const uint64_t wdata = rxq->wdata;
> >         const uint32_t qmask = rxq->qmask;
> >         const uintptr_t desc = rxq->desc;
> > --
> > 2.35.6
> >