patch 'net/memif: fix multi-segment Rx corruption' has been queued to stable release 23.11.7

[Shani Peretz]

Hi,

FYI, your patch has been queued to stable release 23.11.7

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 04/19/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/shanipr/dpdk-stable

This queued commit can be viewed at:
https://github.com/shanipr/dpdk-stable/commit/08fb19dfd8d0f9adcb45909c61c76b753c36836f

Thanks.

Shani

---
>From 08fb19dfd8d0f9adcb45909c61c76b753c36836f Mon Sep 17 00:00:00 2001
From: Sriram Yagnaraman <sriram.yagnaraman at ericsson.com>
Date: Tue, 24 Mar 2026 17:14:36 +0100
Subject: [PATCH] net/memif: fix multi-segment Rx corruption

[ upstream commit 40e0e7c0a2236adde8c398515619347d9948b8d3 ]

Fix dst_off being reset per-descriptor instead of per-packet in the Rx
slow path. When processing chained descriptors (MEMIF_DESC_FLAG_NEXT),
goto next_slot2 reset dst_off to 0, overwriting the beginning of the
current mbuf with data from subsequent descriptors. Move dst_off
initialization before the next_slot2 label so it is only reset once
per packet.

Add boundary check in both Rx paths before processing next segment.
If MEMIF_DESC_FLAG_NEXT is set but n_slots is 0, free the incomplete
mbuf chain and exit gracefully to prevent reading beyond available
descriptors.

Bugzilla ID: 1609
Fixes: aa17df860891 ("net/memif: add a Rx fast path")

Reported-by: Mike Bly <bly454 at gmail.com>
Signed-off-by: Sriram Yagnaraman <sriram.yagnaraman at ericsson.com>
---
 .mailmap                          |  1 +
 drivers/net/memif/rte_eth_memif.c | 19 +++++++++++++++++--
 drivers/net/memif/rte_eth_memif.h |  1 +
 3 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/.mailmap b/.mailmap
index e53812ea16..04465f8ded 100644
--- a/.mailmap
+++ b/.mailmap
@@ -997,6 +997,7 @@ Miguel Bernal Marin <miguel.bernal.marin at linux.intel.com>
 Mihai Brodschi <mihai.brodschi at broadcom.com>
 Mihai Pogonaru <pogonarumihai at gmail.com>
 Mike Baucom <michael.baucom at broadcom.com>
+Mike Bly <bly454 at gmail.com>
 Mike Pattrick <mkp at redhat.com>
 Mike Sowka <msowka at gmail.com>
 Mike Stolarchuk <mike.stolarchuk at bigswitch.com>
diff --git a/drivers/net/memif/rte_eth_memif.c b/drivers/net/memif/rte_eth_memif.c
index d34d26608c..ed525bbc5e 100644
--- a/drivers/net/memif/rte_eth_memif.c
+++ b/drivers/net/memif/rte_eth_memif.c
@@ -376,6 +376,12 @@ next_slot1:
 			n_slots--;
 
 			if (d0->flags & MEMIF_DESC_FLAG_NEXT) {
+				if (unlikely(n_slots == 0)) {
+					mq->n_err++;
+					rte_pktmbuf_free_bulk(mbufs + rx_pkts,
+							MAX_PKT_BURST - rx_pkts);
+					goto no_free_bufs;
+				}
 				mbuf_tail = mbuf;
 				mbuf = rte_pktmbuf_alloc(mq->mempool);
 				if (unlikely(mbuf == NULL)) {
@@ -414,13 +420,13 @@ next_slot1:
 				goto no_free_bufs;
 			mbuf = mbuf_head;
 			mbuf->port = mq->in_port;
+			dst_off = 0;
 
 next_slot2:
 			s0 = cur_slot & mask;
 			d0 = &ring->desc[s0];
 
 			src_len = d0->length;
-			dst_off = 0;
 			src_off = 0;
 
 			do {
@@ -462,8 +468,14 @@ next_slot2:
 			cur_slot++;
 			n_slots--;
 
-			if (d0->flags & MEMIF_DESC_FLAG_NEXT)
+			if (d0->flags & MEMIF_DESC_FLAG_NEXT) {
+				if (unlikely(n_slots == 0)) {
+					mq->n_err++;
+					rte_pktmbuf_free(mbuf_head);
+					goto no_free_bufs;
+				}
 				goto next_slot2;
+			}
 
 			mq->n_bytes += rte_pktmbuf_pkt_len(mbuf_head);
 			*bufs++ = mbuf_head;
@@ -1594,6 +1606,7 @@ memif_stats_get(struct rte_eth_dev *dev, struct rte_eth_stats *stats)
 		stats->q_ibytes[i] = mq->n_bytes;
 		stats->ipackets += mq->n_pkts;
 		stats->ibytes += mq->n_bytes;
+		stats->ierrors += mq->n_err;
 	}
 
 	tmp = (pmd->role == MEMIF_ROLE_CLIENT) ? pmd->run.num_c2s_rings :
@@ -1624,12 +1637,14 @@ memif_stats_reset(struct rte_eth_dev *dev)
 		    dev->data->rx_queues[i];
 		mq->n_pkts = 0;
 		mq->n_bytes = 0;
+		mq->n_err = 0;
 	}
 	for (i = 0; i < pmd->run.num_s2c_rings; i++) {
 		mq = (pmd->role == MEMIF_ROLE_CLIENT) ? dev->data->rx_queues[i] :
 		    dev->data->tx_queues[i];
 		mq->n_pkts = 0;
 		mq->n_bytes = 0;
+		mq->n_err = 0;
 	}
 
 	return 0;
diff --git a/drivers/net/memif/rte_eth_memif.h b/drivers/net/memif/rte_eth_memif.h
index f21806c811..0cec910538 100644
--- a/drivers/net/memif/rte_eth_memif.h
+++ b/drivers/net/memif/rte_eth_memif.h
@@ -69,6 +69,7 @@ struct memif_queue {
 	/* rx/tx info */
 	uint64_t n_pkts;			/**< number of rx/tx packets */
 	uint64_t n_bytes;			/**< number of rx/tx bytes */
+	uint64_t n_err;				/**< number of rx/tx errors */
 
 	struct rte_intr_handle *intr_handle;	/**< interrupt handle */
 
-- 
2.43.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-04-14 14:44:34.771984119 +0300
+++ 0063-net-memif-fix-multi-segment-Rx-corruption.patch	2026-04-14 14:44:28.709522000 +0300
@@ -1 +1 @@
-From 40e0e7c0a2236adde8c398515619347d9948b8d3 Mon Sep 17 00:00:00 2001
+From 08fb19dfd8d0f9adcb45909c61c76b753c36836f Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 40e0e7c0a2236adde8c398515619347d9948b8d3 ]
+
@@ -20 +21,0 @@
-Cc: stable at dpdk.org
@@ -31 +32 @@
-index 805e5ae762..1d2d2bc7a1 100644
+index e53812ea16..04465f8ded 100644
@@ -34 +35 @@
-@@ -1093,6 +1093,7 @@ Miguel Bernal Marin <miguel.bernal.marin at linux.intel.com>
+@@ -997,6 +997,7 @@ Miguel Bernal Marin <miguel.bernal.marin at linux.intel.com>
@@ -43 +44 @@
-index effcee3721..5d153c3a5a 100644
+index d34d26608c..ed525bbc5e 100644
@@ -46 +47 @@
-@@ -378,6 +378,12 @@ next_slot1:
+@@ -376,6 +376,12 @@ next_slot1:
@@ -59 +60 @@
-@@ -416,13 +422,13 @@ next_slot1:
+@@ -414,13 +420,13 @@ next_slot1:
@@ -74 +75 @@
-@@ -464,8 +470,14 @@ next_slot2:
+@@ -462,8 +468,14 @@ next_slot2:
@@ -90,2 +91,2 @@
-@@ -1607,6 +1619,7 @@ memif_stats_get(struct rte_eth_dev *dev, struct rte_eth_stats *stats,
- 		}
+@@ -1594,6 +1606,7 @@ memif_stats_get(struct rte_eth_dev *dev, struct rte_eth_stats *stats)
+ 		stats->q_ibytes[i] = mq->n_bytes;
@@ -98 +99 @@
-@@ -1639,12 +1652,14 @@ memif_stats_reset(struct rte_eth_dev *dev)
+@@ -1624,12 +1637,14 @@ memif_stats_reset(struct rte_eth_dev *dev)
@@ -114 +115 @@
-index d4e625ab51..9c7a3a93f0 100644
+index f21806c811..0cec910538 100644