patch 'net/mana: fix double free of mbuf on Rx WQE post failure' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 10/29/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/e13e6420fc58350076c402e275da96b2f97f508e

Thanks.

Luca Boccassi

---
>From e13e6420fc58350076c402e275da96b2f97f508e Mon Sep 17 00:00:00 2001
From: Rita Ruvinsky <rita.ruvinsky at weka.io>
Date: Thu, 6 Aug 2026 20:26:40 +0300
Subject: [PATCH] net/mana: fix double free of mbuf on Rx WQE post failure

[ upstream commit 01597534a61c9a82f09010326e8e13cebde8d7e3 ]

mana_post_rx_wqe() frees the mbuf when mana_alloc_pmd_mr() fails, but
the caller already frees the un-posted range starting at that same
mbuf via rte_pktmbuf_free_bulk(&mbufs[i], batch_count - i), so the
mbuf is returned to the mempool twice and can be handed out to two
consumers at once.

The free was correct before the bulk allocation rework, when this
function allocated the mbuf itself. Now that the caller owns it, leave
the mbuf to the caller on every error path.

Fixes: eeb37809601b ("net/mana: use bulk mbuf allocation for Rx WQEs")

Signed-off-by: Rita Ruvinsky <rita.ruvinsky at weka.io>
Reviewed-by: Long Li <longli at microsoft.com>
---
 drivers/net/mana/rx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/mana/rx.c b/drivers/net/mana/rx.c
index 1b8ba1f3a9e..9782dd41160 100644
--- a/drivers/net/mana/rx.c
+++ b/drivers/net/mana/rx.c
@@ -68,10 +68,10 @@ mana_post_rx_wqe(struct mana_rxq *rxq, struct rte_mbuf *mbuf)
 	int ret;
 	struct mana_mr_cache *mr;
 
+	/* Don't free mbuf on error: the caller bulk-frees it from &mbufs[i]. */
 	mr = mana_alloc_pmd_mr(&rxq->mr_btree, priv, mbuf);
 	if (!mr) {
 		DP_LOG(ERR, "failed to register RX MR");
-		rte_pktmbuf_free(mbuf);
 		return -ENOMEM;
 	}
 
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-10-27 11:43:54.354198170 +0000
+++ 0015-net-mana-fix-double-free-of-mbuf-on-Rx-WQE-post-fail.patch	2026-10-27 11:43:53.506059201 +0000
@@ -1 +1 @@
-From 01597534a61c9a82f09010326e8e13cebde8d7e3 Mon Sep 17 00:00:00 2001
+From e13e6420fc58350076c402e275da96b2f97f508e Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 01597534a61c9a82f09010326e8e13cebde8d7e3 ]
+
@@ -17 +18,0 @@
-Cc: stable at dpdk.org
@@ -26 +27 @@
-index aedb05d46f..274c6e88ce 100644
+index 1b8ba1f3a9e..9782dd41160 100644
@@ -29 +30 @@
-@@ -73,10 +73,10 @@ mana_post_rx_wqe(struct mana_rxq *rxq, struct rte_mbuf *mbuf)
+@@ -68,10 +68,10 @@ mana_post_rx_wqe(struct mana_rxq *rxq, struct rte_mbuf *mbuf)