patch 'net/memif: fix multi-segment Rx corruption' has been queued to stable release 25.11.1

[Kevin Traynor]

Hi,

FYI, your patch has been queued to stable release 25.11.1

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 03/31/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/14c59ea75d5d0c25506f159cb66434b8a3384071

Thanks.

Kevin

---
>From 14c59ea75d5d0c25506f159cb66434b8a3384071 Mon Sep 17 00:00:00 2001
From: Sriram Yagnaraman <sriram.yagnaraman at ericsson.com>
Date: Tue, 24 Mar 2026 17:14:36 +0100
Subject: [PATCH] net/memif: fix multi-segment Rx corruption

[ upstream commit 40e0e7c0a2236adde8c398515619347d9948b8d3 ]

Fix dst_off being reset per-descriptor instead of per-packet in the Rx
slow path. When processing chained descriptors (MEMIF_DESC_FLAG_NEXT),
goto next_slot2 reset dst_off to 0, overwriting the beginning of the
current mbuf with data from subsequent descriptors. Move dst_off
initialization before the next_slot2 label so it is only reset once
per packet.

Add boundary check in both Rx paths before processing next segment.
If MEMIF_DESC_FLAG_NEXT is set but n_slots is 0, free the incomplete
mbuf chain and exit gracefully to prevent reading beyond available
descriptors.

Bugzilla ID: 1609
Fixes: aa17df860891 ("net/memif: add a Rx fast path")

Reported-by: Mike Bly <bly454 at gmail.com>
Signed-off-by: Sriram Yagnaraman <sriram.yagnaraman at ericsson.com>
---
 .mailmap                          |  1 +
 drivers/net/memif/rte_eth_memif.c | 19 +++++++++++++++++--
 drivers/net/memif/rte_eth_memif.h |  1 +
 3 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/.mailmap b/.mailmap
index 645659afe0..fe6c46488c 100644
--- a/.mailmap
+++ b/.mailmap
@@ -1092,4 +1092,5 @@ Mihai Brodschi <mihai.brodschi at broadcom.com>
 Mihai Pogonaru <pogonarumihai at gmail.com>
 Mike Baucom <michael.baucom at broadcom.com>
+Mike Bly <bly454 at gmail.com>
 Mike Pattrick <mkp at redhat.com>
 Mike Sowka <msowka at gmail.com>
diff --git a/drivers/net/memif/rte_eth_memif.c b/drivers/net/memif/rte_eth_memif.c
index effcee3721..5d153c3a5a 100644
--- a/drivers/net/memif/rte_eth_memif.c
+++ b/drivers/net/memif/rte_eth_memif.c
@@ -379,4 +379,10 @@ next_slot1:
 
 			if (d0->flags & MEMIF_DESC_FLAG_NEXT) {
+				if (unlikely(n_slots == 0)) {
+					mq->n_err++;
+					rte_pktmbuf_free_bulk(mbufs + rx_pkts,
+							MAX_PKT_BURST - rx_pkts);
+					goto no_free_bufs;
+				}
 				mbuf_tail = mbuf;
 				mbuf = rte_pktmbuf_alloc(mq->mempool);
@@ -417,4 +423,5 @@ next_slot1:
 			mbuf = mbuf_head;
 			mbuf->port = mq->in_port;
+			dst_off = 0;
 
 next_slot2:
@@ -423,5 +430,4 @@ next_slot2:
 
 			src_len = d0->length;
-			dst_off = 0;
 			src_off = 0;
 
@@ -465,6 +471,12 @@ next_slot2:
 			n_slots--;
 
-			if (d0->flags & MEMIF_DESC_FLAG_NEXT)
+			if (d0->flags & MEMIF_DESC_FLAG_NEXT) {
+				if (unlikely(n_slots == 0)) {
+					mq->n_err++;
+					rte_pktmbuf_free(mbuf_head);
+					goto no_free_bufs;
+				}
 				goto next_slot2;
+			}
 
 			mq->n_bytes += rte_pktmbuf_pkt_len(mbuf_head);
@@ -1608,4 +1620,5 @@ memif_stats_get(struct rte_eth_dev *dev, struct rte_eth_stats *stats,
 		stats->ipackets += mq->n_pkts;
 		stats->ibytes += mq->n_bytes;
+		stats->ierrors += mq->n_err;
 	}
 
@@ -1640,4 +1653,5 @@ memif_stats_reset(struct rte_eth_dev *dev)
 		mq->n_pkts = 0;
 		mq->n_bytes = 0;
+		mq->n_err = 0;
 	}
 	for (i = 0; i < pmd->run.num_s2c_rings; i++) {
@@ -1646,4 +1660,5 @@ memif_stats_reset(struct rte_eth_dev *dev)
 		mq->n_pkts = 0;
 		mq->n_bytes = 0;
+		mq->n_err = 0;
 	}
 
diff --git a/drivers/net/memif/rte_eth_memif.h b/drivers/net/memif/rte_eth_memif.h
index d4e625ab51..9c7a3a93f0 100644
--- a/drivers/net/memif/rte_eth_memif.h
+++ b/drivers/net/memif/rte_eth_memif.h
@@ -70,4 +70,5 @@ struct memif_queue {
 	uint64_t n_pkts;			/**< number of rx/tx packets */
 	uint64_t n_bytes;			/**< number of rx/tx bytes */
+	uint64_t n_err;				/**< number of rx/tx errors */
 
 	struct rte_intr_handle *intr_handle;	/**< interrupt handle */
-- 
2.53.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-03-27 09:58:26.275123599 +0000
+++ 0004-net-memif-fix-multi-segment-Rx-corruption.patch	2026-03-27 09:58:26.118625510 +0000
@@ -1 +1 @@
-From 40e0e7c0a2236adde8c398515619347d9948b8d3 Mon Sep 17 00:00:00 2001
+From 14c59ea75d5d0c25506f159cb66434b8a3384071 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 40e0e7c0a2236adde8c398515619347d9948b8d3 ]
+
@@ -20 +21,0 @@
-Cc: stable at dpdk.org
@@ -31 +32 @@
-index 805e5ae762..1d2d2bc7a1 100644
+index 645659afe0..fe6c46488c 100644
@@ -34 +35 @@
-@@ -1094,4 +1094,5 @@ Mihai Brodschi <mihai.brodschi at broadcom.com>
+@@ -1092,4 +1092,5 @@ Mihai Brodschi <mihai.brodschi at broadcom.com>