|WARNING| [v2] gro: fix returned packet count after UDP fragment merge

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: WARNING
https://dpdk.org/patch/172690

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-11-06

# DPDK Patch Review

## ERRORS

None identified.

## WARNINGS

**Missing release notes update**

This patch fixes a serious correctness bug (mempool corruption due to double-free) that affects the GRO library's public API behavior. The fix changes what `rte_gro_reassemble_burst()` returns in certain code paths, which is observable to callers. This should be documented in the current release notes file (`doc/guides/rel_notes/release_26_11.rst` or equivalent).

Suggested action: Add an entry under "Fixed Issues" in `doc/guides/rel_notes/` describing the bug fix.

---

**Potentially misleading Fixes tag timeline**

The commit message states that commit `74080d7dcf31` ("gro: support IPv6 for TCP") introduced the double-counting bug. However, the actual code change is in the shared UDP/IPv4 GRO logic that predates IPv6-for-TCP support. The v2 changelog claims releases before that rework "recompute the count as i + unprocess_num" and are unaffected, but this should be verified by checking the code history.

The Fixes tag determines which stable branches receive the backport. If the bug truly exists only from `74080d7dcf31` onward, the tag is correct. If it exists in earlier code that also uses `nb_after_gro` for the return value, the tag should point to the earlier commit.

Suggested action: Verify that the bug does not exist in releases prior to `74080d7dcf31`. If it does, update the Fixes tag to point to the commit that first introduced the `return nb_after_gro` pattern without accounting for flush-time merges.

---

## INFO

**Code logic verification**

The fix changes the return value from `nb_after_gro` to `i` at line 352. Tracing the code:

- `i` is initialized to 0 before the main processing loop (line not shown in patch, but standard pattern)
- In the loop, `i` is incremented for each packet written to `pkts[]` after GRO processing
- `nb_after_gro` is decremented when a packet is merged *during insertion*, but not when `gro_udp4_merge_items()` merges packets during the flush at lines 339-347
- After the flush block, `i` holds the actual count of valid entries in `pkts[]`
- In the non-flush path (when the `if` at line 331 is false), `i` would equal `nb_pkts`, which also equals `nb_after_gro` (no packets were dropped or merged), so the return value is unchanged in that case

The fix is correct: returning `i` gives the true packet count in all cases, fixing the double-free and garbage-packet bugs described in the commit message.

---

**Scope of the bug**

The commit message identifies that the bug causes:
1. Mempool corruption (double-free of mbufs already chained into earlier packets)
2. Caller receives a "standalone packet built from fragment payload" (the surplus entry with headers stripped)

Both are serious correctness bugs. The fix is minimal and addresses the root cause (wrong return value).

---

Review-Result: WARNING