patch 'net/mlx5: fix double free in vectorized Rx recovery' has been queued to stable release 24.11.7

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.7

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 07/22/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/72712e4314b2b97da38091bd729618bcfb788434

Thanks.

Luca Boccassi

---
>From 72712e4314b2b97da38091bd729618bcfb788434 Mon Sep 17 00:00:00 2001
From: Borys Tsyrulnikov <tsyrulnikov.borys at gmail.com>
Date: Wed, 17 Jun 2026 16:43:01 +0300
Subject: [PATCH] net/mlx5: fix double free in vectorized Rx recovery

[ upstream commit 7b3add55404dd816f1e9610097b2a7ac1fca4713 ]

During Rx queue error recovery, the vectorized path in
mlx5_rx_err_handle() reallocates an mbuf for every queue element. When
rte_mbuf_raw_alloc() fails (for example, the mempool is exhausted), the
rollback loop frees the mbufs allocated so far, but masks the element
ring index with "& elts_n" instead of "& (elts_n - 1)".

elts_n is a power-of-two element count, so "x & elts_n" isolates a
single bit and can only evaluate to 0 or elts_n, regardless of the loop
counter. The rollback therefore never frees the mbufs just allocated in
this pass (they are leaked); instead it repeatedly frees elts[0], a live
mbuf still posted to the NIC (use-after-free / double free), and
elts[elts_n], the fake_mbuf padding entry used by the vector datapath.

Mask with the existing e_mask (elts_n - 1), as already done in the
matching forward allocation loop just above.

Fixes: 0f20acbf5eda ("net/mlx5: implement vectorized MPRQ burst")

Signed-off-by: Borys Tsyrulnikov <tsyrulnikov.borys at gmail.com>
Acked-by: Dariusz Sosnowski <dsosnowski at nvidia.com>
---
 .mailmap                   | 1 +
 drivers/net/mlx5/mlx5_rx.c | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.mailmap b/.mailmap
index d10d372387..6a3225e08f 100644
--- a/.mailmap
+++ b/.mailmap
@@ -213,6 +213,7 @@ Boleslav Stankevich <boleslav.stankevich at oktetlabs.ru>
 Boon Ang <boon.ang at broadcom.com> <bang at vmware.com>
 Boris Ouretskey <borisusun at gmail.com>
 Boris Pismenny <borisp at mellanox.com>
+Borys Tsyrulnikov <tsyrulnikov.borys at gmail.com>
 Brad Larson <bradley.larson at amd.com>
 Brandon Lo <blo at iol.unh.edu>
 Brendan Ryan <brendan.ryan at intel.com>
diff --git a/drivers/net/mlx5/mlx5_rx.c b/drivers/net/mlx5/mlx5_rx.c
index 17545e3d73..7dc393d80a 100644
--- a/drivers/net/mlx5/mlx5_rx.c
+++ b/drivers/net/mlx5/mlx5_rx.c
@@ -661,7 +661,7 @@ mlx5_rx_err_handle(struct mlx5_rxq_data *rxq, uint8_t vec,
 					if (!*elt) {
 						for (i--; i >= 0; --i) {
 							elt_idx = (elts_ci +
-								   i) & elts_n;
+								   i) & e_mask;
 							elt = &(*rxq->elts)
 								[elt_idx];
 							rte_pktmbuf_free_seg
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-20 18:03:26.110606695 +0100
+++ 0016-net-mlx5-fix-double-free-in-vectorized-Rx-recovery.patch	2026-07-20 18:03:25.512443363 +0100
@@ -1 +1 @@
-From 7b3add55404dd816f1e9610097b2a7ac1fca4713 Mon Sep 17 00:00:00 2001
+From 72712e4314b2b97da38091bd729618bcfb788434 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 7b3add55404dd816f1e9610097b2a7ac1fca4713 ]
+
@@ -23 +24,0 @@
-Cc: stable at dpdk.org
@@ -33 +34 @@
-index ed875c0835..122ff08635 100644
+index d10d372387..6a3225e08f 100644
@@ -36 +37 @@
-@@ -224,6 +224,7 @@ Boleslav Stankevich <boleslav.stankevich at oktetlabs.ru>
+@@ -213,6 +213,7 @@ Boleslav Stankevich <boleslav.stankevich at oktetlabs.ru>
@@ -45 +46 @@
-index ce50087b70..c0ad8d6701 100644
+index 17545e3d73..7dc393d80a 100644
@@ -48 +49 @@
-@@ -662,7 +662,7 @@ mlx5_rx_err_handle(struct mlx5_rxq_data *rxq, uint8_t vec,
+@@ -661,7 +661,7 @@ mlx5_rx_err_handle(struct mlx5_rxq_data *rxq, uint8_t vec,