<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style></style></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><a name="_MailEndCompose">There where there already.<o:p></o:p></a>The patch only changes the size of some local variables.<o:p></o:p><o:p> </o:p>Venlig hilsen / Kind regards,<o:p></o:p>-Morten Brørup<o:p></o:p><o:p> </o:p><div style='border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt'><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'>From: Stephen Hemminger [mailto:stephen@networkplumber.org] Sent: Wednesday, 9 September 2026 19.16 To: Randy L Tice Cc: dev; stable; Thomas Monjalon; Pavan Nikhilesh; Shijith Thotton; Nithin Dabilpuram; Kiran Kumar K; Sunil Kumar Kori; Satha Rao; Harman Kalra; rbhansali@marvell.com Subject: Re: [PATCH 1/1] drivers: fix CN20K mbuf size truncation<o:p></o:p></div></div><o:p> </o:p><div>stop "cargo culting" use of always inline attribute. that attribute should only be used in special cases where code breaks compilation without it. it is not a go faster flag<o:p></o:p></div><o:p> </o:p><div><div>On Wed, Sep 9, 2026, 09:06 Randy L Tice <<a href="mailto:rtice@cisco.com">rtice@cisco.com</a>> wrote:<o:p></o:p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm'>CN20K inline security receive paths recover the packet mbuf by subtracting sizeof(struct rte_mbuf) from a pointer stored in completion metadata. The size is currently kept in a uint8_t local variable before that subtraction. This truncates the value when the mbuf structure grows beyond 255 bytes, and can recover the wrong mbuf address. Use a uint32_t local value for the mbuf byte size so larger mbuf layouts are handled correctly. Fixes: 5856f23129bb ("net/cnxk: support CN20K inline IPsec Rx") Fixes: edd0d5f3c299 ("event/cnxk: support CN20K inline IPsec Rx") Cc: <a href="mailto:stable@dpdk.org" target="_blank">stable@dpdk.org</a> Signed-off-by: Randy L Tice <<a href="mailto:rtice@cisco.com" target="_blank">rtice@cisco.com</a>> --- .mailmap | 1 + drivers/event/cnxk/cn20k_worker.h | 4 ++-- drivers/net/cnxk/cn20k_rx.h | 4 ++-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/.mailmap b/.mailmap index fcb3d1bb3f..2a8b54ea23 100644 --- a/.mailmap +++ b/.mailmap @@ -1379,6 +1379,7 @@ Rakesh Kudurumalla <<a href="mailto:rkudurumalla@marvell.com" target="_blank">rkudurumalla@marvell.com</a>> <<a href="mailto:rkudurumalla@caviumnetworks.com" target="_blank">rkudurumalla@caviumnetworks.com</a>> Ralf Hoffmann <<a href="mailto:ralf.hoffmann@allegro-packets.com" target="_blank">ralf.hoffmann@allegro-packets.com</a>> Rami Rosen <<a href="mailto:ramirose@gmail.com" target="_blank">ramirose@gmail.com</a>> <<a href="mailto:rami.rosen@intel.com" target="_blank">rami.rosen@intel.com</a>> Rami Rosen <<a href="mailto:ramirose@gmail.com" target="_blank">ramirose@gmail.com</a>> <<a href="mailto:roszenrami@gmail.com" target="_blank">roszenrami@gmail.com</a>> +Randy L Tice <<a href="mailto:rtice@cisco.com" target="_blank">rtice@cisco.com</a>> Randy Schacher <<a href="mailto:stuart.schacher@broadcom.com" target="_blank">stuart.schacher@broadcom.com</a>> Rani Sharoni <<a href="mailto:ranish@nvidia.com" target="_blank">ranish@nvidia.com</a>> Ranjit Menon <<a href="mailto:ranjit.menon@intel.com" target="_blank">ranjit.menon@intel.com</a>> diff --git a/drivers/event/cnxk/cn20k_worker.h b/drivers/event/cnxk/cn20k_worker.h index 6442113e09..5723a6eabb 100644 --- a/drivers/event/cnxk/cn20k_worker.h +++ b/drivers/event/cnxk/cn20k_worker.h @@ -48,7 +48,7 @@ cn20k_process_vwqe(uintptr_t vwqe, uint16_t port_id, const uint32_t flags, struc { uint64_t mbuf_init = 0x100010000ULL | RTE_PKTMBUF_HEADROOM; struct cnxk_timesync_info *tstamp = ws->tstamp[port_id]; - uint8_t m_sz = sizeof(struct rte_mbuf); + const uint32_t m_sz = sizeof(struct rte_mbuf); void *lookup_mem = ws->lookup_mem; uint64_t meta_aura = 0, laddr = 0; uintptr_t lbase = ws->lmt_base; @@ -165,7 +165,7 @@ cn20k_process_vwqe(uintptr_t vwqe, uint16_t port_id, const uint32_t flags, struc static __rte_always_inline void cn20k_sso_hws_post_process(struct cn20k_sso_hws *ws, uint64_t *u64, const uint32_t flags) { - uint8_t m_sz = sizeof(struct rte_mbuf); + const uint32_t m_sz = sizeof(struct rte_mbuf); uintptr_t sa_base = 0; u64[0] = (u64[0] & (0x3ull << 32)) << 6 | (u64[0] & (0x3FFull << 36)) << 4 | diff --git a/drivers/net/cnxk/cn20k_rx.h b/drivers/net/cnxk/cn20k_rx.h index f8fa6de2b9..b544868c03 100644 --- a/drivers/net/cnxk/cn20k_rx.h +++ b/drivers/net/cnxk/cn20k_rx.h @@ -702,7 +702,7 @@ cn20k_nix_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t pkts, co uint64_t mbuf_init = rxq->mbuf_initializer; const void *lookup_mem = rxq->lookup_mem; const uint64_t data_off = rxq->data_off; - uint8_t m_sz = sizeof(struct rte_mbuf); + const uint32_t m_sz = sizeof(struct rte_mbuf); const uint64_t wdata = rxq->wdata; const uint32_t qmask = rxq->qmask; const uintptr_t desc = rxq->desc; @@ -815,7 +815,7 @@ cn20k_nix_flush_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t pk uint64_t mbuf_init = rxq->mbuf_initializer; const void *lookup_mem = rxq->lookup_mem; const uint64_t data_off = rxq->data_off; - uint8_t m_sz = sizeof(struct rte_mbuf); + const uint32_t m_sz = sizeof(struct rte_mbuf); const uint64_t wdata = rxq->wdata; const uint32_t qmask = rxq->qmask; const uintptr_t desc = rxq->desc; -- 2.35.6<o:p></o:p></blockquote></div></div></div></body></html>