patch 'net/mlx5: fix out-of-bounds stride index in vector Rx' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 11/07/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/22ad3e50f88bf42ea5be7a67df05cba1c46f392a

Thanks.

Luca Boccassi

---
>From 22ad3e50f88bf42ea5be7a67df05cba1c46f392a Mon Sep 17 00:00:00 2001
From: Stephen Hemminger <stephen at networkplumber.org>
Date: Mon, 12 Oct 2026 09:34:32 -0700
Subject: [PATCH] net/mlx5: fix out-of-bounds stride index in vector Rx

[ upstream commit c1b23e9980d18549c32c71bdedd9c953195af42d ]

The vectorized MPRQ path uses the software counter consumed_strd as the
stride index, resetting it only when it equals strd_n. The per-packet
stride count comes from pkt_len, which may not match the strides the
device consumed, so under load consumed_strd can drift past strd_n. The
stale index then makes mprq_buf_to_pkt() read buf->shinfos[] and the
stride offset out of bounds, corrupting mbuf metadata or accessing past
the buffer.

Drop the packet and realign to the next WQE when the stride index would
leave the buffer.

Bugzilla ID: 1369
Fixes: 0f20acbf5eda ("net/mlx5: implement vectorized MPRQ burst")

Reported-by: Kamil Vojanec <vojanec at cesnet.cz>
Signed-off-by: Stephen Hemminger <stephen at networkplumber.org>
---
 drivers/net/mlx5/mlx5_rxtx_vec.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/net/mlx5/mlx5_rxtx_vec.c b/drivers/net/mlx5/mlx5_rxtx_vec.c
index 6d70609c41b..228ff2bfcb1 100644
--- a/drivers/net/mlx5/mlx5_rxtx_vec.c
+++ b/drivers/net/mlx5/mlx5_rxtx_vec.c
@@ -244,6 +244,20 @@ rxq_copy_mprq_mbuf_v(struct mlx5_rxq_data *rxq,
 		}
 		strd_cnt = (elts[i]->pkt_len / strd_sz) +
 			   ((elts[i]->pkt_len % strd_sz) ? 1 : 0);
+		/* Drop and realign if the stride index drifted past the
+		 * buffer, rather than letting mprq_buf_to_pkt() index
+		 * past shinfos[] and the stride region (bug 1369).
+		 */
+		if (unlikely(rxq->consumed_strd + strd_cnt > strd_n)) {
+			rxq->consumed_strd = strd_n;
+			rte_pktmbuf_free_seg(elts[i]);
+#ifdef MLX5_PMD_SOFT_COUNTERS
+			rxq->stats.ipackets -= 1;
+			rxq->stats.ibytes -= elts[i]->pkt_len;
+#endif
+			++rxq->stats.idropped;
+			continue;
+		}
 		rxq_code = mprq_buf_to_pkt(rxq, elts[i], elts[i]->pkt_len,
 					   buf, rxq->consumed_strd, strd_cnt);
 		rxq->consumed_strd += strd_cnt;
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-11-05 16:42:45.802994052 +0000
+++ 0020-net-mlx5-fix-out-of-bounds-stride-index-in-vector-Rx.patch	2026-11-05 16:42:44.909060428 +0000
@@ -1 +1 @@
-From c1b23e9980d18549c32c71bdedd9c953195af42d Mon Sep 17 00:00:00 2001
+From 22ad3e50f88bf42ea5be7a67df05cba1c46f392a Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit c1b23e9980d18549c32c71bdedd9c953195af42d ]
+
@@ -19 +20,0 @@
-Cc: stable at dpdk.org
@@ -28 +29 @@
-index 6d70609c41..228ff2bfcb 100644
+index 6d70609c41b..228ff2bfcb1 100644