patch 'net/mlx5: fix double free in vectorized Rx recovery' has been queued to stable release 25.11.3

[Kevin Traynor]

Hi,

FYI, your patch has been queued to stable release 25.11.3

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 08/04/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/8dc91f6fd04f66dea5e088e3871b7081e1e6791d

Thanks.

Kevin

---
>From 8dc91f6fd04f66dea5e088e3871b7081e1e6791d Mon Sep 17 00:00:00 2001
From: Borys Tsyrulnikov <tsyrulnikov.borys at gmail.com>
Date: Wed, 17 Jun 2026 16:43:01 +0300
Subject: [PATCH] net/mlx5: fix double free in vectorized Rx recovery

[ upstream commit 7b3add55404dd816f1e9610097b2a7ac1fca4713 ]

During Rx queue error recovery, the vectorized path in
mlx5_rx_err_handle() reallocates an mbuf for every queue element. When
rte_mbuf_raw_alloc() fails (for example, the mempool is exhausted), the
rollback loop frees the mbufs allocated so far, but masks the element
ring index with "& elts_n" instead of "& (elts_n - 1)".

elts_n is a power-of-two element count, so "x & elts_n" isolates a
single bit and can only evaluate to 0 or elts_n, regardless of the loop
counter. The rollback therefore never frees the mbufs just allocated in
this pass (they are leaked); instead it repeatedly frees elts[0], a live
mbuf still posted to the NIC (use-after-free / double free), and
elts[elts_n], the fake_mbuf padding entry used by the vector datapath.

Mask with the existing e_mask (elts_n - 1), as already done in the
matching forward allocation loop just above.

Fixes: 0f20acbf5eda ("net/mlx5: implement vectorized MPRQ burst")

Signed-off-by: Borys Tsyrulnikov <tsyrulnikov.borys at gmail.com>
Acked-by: Dariusz Sosnowski <dsosnowski at nvidia.com>
---
 .mailmap                   | 1 +
 drivers/net/mlx5/mlx5_rx.c | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.mailmap b/.mailmap
index b84214567d..a1b9409b13 100644
--- a/.mailmap
+++ b/.mailmap
@@ -222,4 +222,5 @@ Boon Ang <boon.ang at broadcom.com> <bang at vmware.com>
 Boris Ouretskey <borisusun at gmail.com>
 Boris Pismenny <borisp at mellanox.com>
+Borys Tsyrulnikov <tsyrulnikov.borys at gmail.com>
 Brad Larson <bradley.larson at amd.com>
 Brandon Lo <blo at iol.unh.edu>
diff --git a/drivers/net/mlx5/mlx5_rx.c b/drivers/net/mlx5/mlx5_rx.c
index ff734639e5..eead1fd538 100644
--- a/drivers/net/mlx5/mlx5_rx.c
+++ b/drivers/net/mlx5/mlx5_rx.c
@@ -663,5 +663,5 @@ mlx5_rx_err_handle(struct mlx5_rxq_data *rxq, uint8_t vec,
 						for (i--; i >= 0; --i) {
 							elt_idx = (elts_ci +
-								   i) & elts_n;
+								   i) & e_mask;
 							elt = &(*rxq->elts)
 								[elt_idx];
-- 
2.55.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-30 10:16:03.964911635 +0100
+++ 0088-net-mlx5-fix-double-free-in-vectorized-Rx-recovery.patch	2026-07-30 10:16:01.509983317 +0100
@@ -1 +1 @@
-From 7b3add55404dd816f1e9610097b2a7ac1fca4713 Mon Sep 17 00:00:00 2001
+From 8dc91f6fd04f66dea5e088e3871b7081e1e6791d Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 7b3add55404dd816f1e9610097b2a7ac1fca4713 ]
+
@@ -23 +24,0 @@
-Cc: stable at dpdk.org
@@ -33 +34 @@
-index ed875c0835..122ff08635 100644
+index b84214567d..a1b9409b13 100644
@@ -36 +37 @@
-@@ -225,4 +225,5 @@ Boon Ang <boon.ang at broadcom.com> <bang at vmware.com>
+@@ -222,4 +222,5 @@ Boon Ang <boon.ang at broadcom.com> <bang at vmware.com>
@@ -43 +44 @@
-index ce50087b70..c0ad8d6701 100644
+index ff734639e5..eead1fd538 100644