[PATCH v2 11/17] net/dpaa2: fix software taildrop buffer access

[Stephen Hemminger]

On Thu, 26 Feb 2026 15:33:35 +0100
Maxime Leroy <maxime at leroys.fr> wrote:

> The sw_td path in dpaa2_dev_tx() reads from the wrong position in the
> bufs array. When the goto fires, bufs has already been advanced past
> the num_tx successfully sent packets. The first loop then reads num_tx
> more entries starting from bufs, going past the end of the input array.
> Additionally, the buf_to_free segments for already-enqueued packets
> are never freed, leaking memory.
> 
> Replace the buggy sw_td code with the same pattern used in
> dpaa2_dev_tx_ordered(): free buf_to_free segments first, then use
> rte_pktmbuf_free_bulk() to drop remaining unsent packets.
> 
> Not tested, found by code review.
> 
> Cc: stable at dpdk.org
> Fixes: c3ffe74d85be ("net/dpaa2: support software taildrop")
> 
> Reported-by: Stephen Hemminger <stephen at networkplumber.org>
> Signed-off-by: Maxime Leroy <maxime at leroys.fr>
> ---
>  drivers/net/dpaa2/dpaa2_rxtx.c | 18 ++++++------------
>  1 file changed, 6 insertions(+), 12 deletions(-)
> 
> diff --git a/drivers/net/dpaa2/dpaa2_rxtx.c b/drivers/net/dpaa2/dpaa2_rxtx.c
> index 689e5e7ee7..8275ba9780 100644
> --- a/drivers/net/dpaa2/dpaa2_rxtx.c
> +++ b/drivers/net/dpaa2/dpaa2_rxtx.c
> @@ -1517,21 +1517,15 @@ dpaa2_dev_tx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
>  
>  	return num_tx;
>  sw_td:
> -	loop = 0;
> -	while (loop < num_tx) {
> -		if (unlikely(RTE_MBUF_HAS_EXTBUF(*bufs)))
> -			rte_pktmbuf_free(*bufs);
> -		bufs++;
> -		loop++;
> +	for (loop = 0; loop < free_count; loop++) {
> +		if (buf_to_free[loop].pkt_id < num_tx)
> +			rte_pktmbuf_free_seg(buf_to_free[loop].seg);
>  	}
>  
>  	/* free the pending buffers */
> -	while (nb_pkts) {
> -		rte_pktmbuf_free(*bufs);
> -		bufs++;
> -		nb_pkts--;
> -		num_tx++;
> -	}
> +	rte_pktmbuf_free_bulk(bufs, nb_pkts);

It is unsafe to use free_bulk on transmit path because packets in
burst might come from different pools. An example would be a router
forwarding from two incoming NIC's to one outgoing NIC. 

Unlikely, but using bulk here is incorrect.

You are right though old code had other bugs.