patch 'net/dpaa2: fix software taildrop buffer access' has been queued to stable release 25.11.1

[Kevin Traynor]

Hi,

FYI, your patch has been queued to stable release 25.11.1

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 04/03/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/9f79b89a6525d5c9bd7005f4e3df8b68f6518f0a

Thanks.

Kevin

---
>From 9f79b89a6525d5c9bd7005f4e3df8b68f6518f0a Mon Sep 17 00:00:00 2001
From: Maxime Leroy <maxime at leroys.fr>
Date: Wed, 25 Mar 2026 21:45:38 +0100
Subject: [PATCH] net/dpaa2: fix software taildrop buffer access

[ upstream commit 3cb5e6929f97f171bc1d0211bbee2ea0104c6eec ]

The sw_td path in dpaa2_dev_tx() reads from the wrong position in the
bufs array. When the goto fires, bufs has already been advanced past
the num_tx successfully sent packets. The first loop then reads num_tx
more entries starting from bufs, going past the end of the input array.
Additionally, the buf_to_free segments for already-enqueued packets
are never freed, leaking memory.

Replace the buggy sw_td code with the same pattern used in
dpaa2_dev_tx_ordered(): free buf_to_free segments first, then use
rte_pktmbuf_free_bulk() to drop remaining unsent packets.

Not tested, found by code review.

Fixes: c3ffe74d85be ("net/dpaa2: support software taildrop")

Reported-by: Stephen Hemminger <stephen at networkplumber.org>
Signed-off-by: Maxime Leroy <maxime at leroys.fr>
Acked-by: Hemant Agrawal <hemant.agrawal at nxp.com>
---
 drivers/net/dpaa2/dpaa2_rxtx.c | 18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

diff --git a/drivers/net/dpaa2/dpaa2_rxtx.c b/drivers/net/dpaa2/dpaa2_rxtx.c
index 689e5e7ee7..8275ba9780 100644
--- a/drivers/net/dpaa2/dpaa2_rxtx.c
+++ b/drivers/net/dpaa2/dpaa2_rxtx.c
@@ -1518,19 +1518,13 @@ skip_tx:
 	return num_tx;
 sw_td:
-	loop = 0;
-	while (loop < num_tx) {
-		if (unlikely(RTE_MBUF_HAS_EXTBUF(*bufs)))
-			rte_pktmbuf_free(*bufs);
-		bufs++;
-		loop++;
+	for (loop = 0; loop < free_count; loop++) {
+		if (buf_to_free[loop].pkt_id < num_tx)
+			rte_pktmbuf_free_seg(buf_to_free[loop].seg);
 	}
 
 	/* free the pending buffers */
-	while (nb_pkts) {
-		rte_pktmbuf_free(*bufs);
-		bufs++;
-		nb_pkts--;
-		num_tx++;
-	}
+	rte_pktmbuf_free_bulk(bufs, nb_pkts);
+
+	num_tx += nb_pkts;
 	dpaa2_q->tx_pkts += num_tx;
 
-- 
2.53.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-04-01 12:56:52.406130880 +0100
+++ 0014-net-dpaa2-fix-software-taildrop-buffer-access.patch	2026-04-01 12:56:52.017391696 +0100
@@ -1 +1 @@
-From 3cb5e6929f97f171bc1d0211bbee2ea0104c6eec Mon Sep 17 00:00:00 2001
+From 9f79b89a6525d5c9bd7005f4e3df8b68f6518f0a Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 3cb5e6929f97f171bc1d0211bbee2ea0104c6eec ]
+
@@ -20 +21,0 @@
-Cc: stable at dpdk.org