patch 'net/mlx5: restore fake mbuf guards on Rx replenish failure' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 11/07/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/f5d1e3da86cdb3f677413dae2b721e1c1d062c05

Thanks.

Luca Boccassi

---
>From f5d1e3da86cdb3f677413dae2b721e1c1d062c05 Mon Sep 17 00:00:00 2001
From: Mikhail Mamatov <mmamatov at nfware.com>
Date: Thu, 24 Sep 2026 22:13:03 +0300
Subject: [PATCH] net/mlx5: restore fake mbuf guards on Rx replenish failure

[ upstream commit 1d2ba4dfedbb78036199def64c4259fa912ff26f ]

Vectorized Rx keeps MLX5_VPMD_DESCS_PER_LOOP entries of elts[] pointing
to rxq->fake_mbuf after the allocated mbufs. Both rxq_cq_process_v() and
rxq_cq_decompress_v() write mbuf metadata for full SIMD groups. In
particular, CQE decompression may write through these guard entries
when processing a partial trailing group.

Both mlx5_rx_replenish_bulk_mbuf() and
mlx5_rx_mprq_replenish_bulk_mbuf() pass the guard slots directly to
rte_mempool_get_bulk(). Since a2833ecc5ea4, the mempool get path copies
available objects from the per-lcore cache to the output array before
fetching the remaining objects from the backend. If the cache contains
fewer objects than requested and the backend cannot supply the rest,
the operation restores the cache length but leaves the output array
partially overwritten.

Returning from replenishment without restoring the guards therefore
leaves them pointing to mbufs still owned by the mempool. A later
allocation can hand these mbufs to the application, after which CQE
decompression may corrupt their metadata through the stale pointers.

Restore the four fake mbuf pointers on allocation failure in both the
regular and MPRQ vector Rx paths. The producer index does not advance
on failure, so restoring the guards at the original allocation position
is sufficient. This adds work only on the allocation failure path.

Fixes: a2833ecc5ea4 ("mempool: fix get objects from mempool with cache")

Signed-off-by: Mikhail Mamatov <mmamatov at nfware.com>
Signed-off-by: Pavel Ivashchenko <pivashchenko at nfware.com>
Acked-by: Dariusz Sosnowski <dsosnowski at nvidia.com>
---
 .mailmap                         |  2 ++
 drivers/net/mlx5/mlx5_rxtx_vec.c | 12 ++++++++++++
 2 files changed, 14 insertions(+)

diff --git a/.mailmap b/.mailmap
index d0140b9dcb3..33b0aa12482 100644
--- a/.mailmap
+++ b/.mailmap
@@ -1089,6 +1089,8 @@ Mike Pattrick <mkp at redhat.com>
 Mike Sowka <msowka at gmail.com>
 Mike Stolarchuk <mike.stolarchuk at bigswitch.com>
 Mike Ximing Chen <mike.ximing.chen at intel.com>
+Mikhail Mamatov <mmamatov at nfware.com>
+Mikolaj Filar <mikolajx.filar at intel.com>
 Milena Olech <milena.olech at intel.com>
 Min Cao <min.cao at intel.com>
 Minggang Li (Gavin) <gavinl at nvidia.com>
diff --git a/drivers/net/mlx5/mlx5_rxtx_vec.c b/drivers/net/mlx5/mlx5_rxtx_vec.c
index 79e92811d50..6d70609c41b 100644
--- a/drivers/net/mlx5/mlx5_rxtx_vec.c
+++ b/drivers/net/mlx5/mlx5_rxtx_vec.c
@@ -105,6 +105,15 @@ mlx5_rx_replenish_bulk_mbuf(struct mlx5_rxq_data *rxq)
 		n = RTE_MIN(n - MLX5_VPMD_DESCS_PER_LOOP, q_n - elts_idx);
 		if (rte_mempool_get_bulk(rxq->mp, (void *)elts, n) < 0) {
 			rxq->stats.rx_nombuf += n;
+			/*
+			 * A failed bulk get may have partially filled elts[]
+			 * from the cache without dequeueing those objects.
+			 * Restore the fake_mbuf guards so a following
+			 * decompression does not write into mbufs that are
+			 * still owned by the mempool (or by the application).
+			 */
+			for (i = 0; i < MLX5_VPMD_DESCS_PER_LOOP; ++i)
+				elts[i] = &rxq->fake_mbuf;
 			return;
 		}
 		if (unlikely(mlx5_mr_btree_len(&rxq->mr_ctrl.cache_bh) > 1)) {
@@ -169,6 +178,9 @@ mlx5_rx_mprq_replenish_bulk_mbuf(struct mlx5_rxq_data *rxq)
 		n = RTE_MIN(n, rxq->rq_repl_thresh);
 		if (rte_mempool_get_bulk(rxq->mp, (void *)elts, n) < 0) {
 			rxq->stats.rx_nombuf += n;
+			/* See mlx5_rx_replenish_bulk_mbuf(). */
+			for (i = 0; i < MLX5_VPMD_DESCS_PER_LOOP; ++i)
+				elts[i] = &rxq->fake_mbuf;
 			return;
 		}
 		rxq->elts_ci += n;
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-11-05 16:42:45.766490668 +0000
+++ 0019-net-mlx5-restore-fake-mbuf-guards-on-Rx-replenish-fa.patch	2026-11-05 16:42:44.909060428 +0000
@@ -1 +1 @@
-From 1d2ba4dfedbb78036199def64c4259fa912ff26f Mon Sep 17 00:00:00 2001
+From f5d1e3da86cdb3f677413dae2b721e1c1d062c05 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 1d2ba4dfedbb78036199def64c4259fa912ff26f ]
+
@@ -32 +33,0 @@
-Cc: stable at dpdk.org
@@ -38 +39 @@
- .mailmap                         |  1 +
+ .mailmap                         |  2 ++
@@ -40 +41 @@
- 2 files changed, 13 insertions(+)
+ 2 files changed, 14 insertions(+)
@@ -43 +44 @@
-index 5593234047..9f55751964 100644
+index d0140b9dcb3..33b0aa12482 100644
@@ -46 +47 @@
-@@ -1147,6 +1147,7 @@ Mike Pattrick <mkp at redhat.com>
+@@ -1089,6 +1089,8 @@ Mike Pattrick <mkp at redhat.com>
@@ -51 +52 @@
- Mikolaj Filar <mikolajx.filar at intel.com>
++Mikolaj Filar <mikolajx.filar at intel.com>
@@ -53,0 +55 @@
+ Minggang Li (Gavin) <gavinl at nvidia.com>
@@ -55 +57 @@
-index 79e92811d5..6d70609c41 100644
+index 79e92811d50..6d70609c41b 100644