|WARNING| net/mlx5: restore fake mbuf guards on Rx replenish failure

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: WARNING
https://dpdk.org/patch/170025

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-09-24

# DPDK Patch Review

## Summary
This patch fixes a correctness bug in the mlx5 PMD vectorized Rx path where allocation failure could leave stale mbuf pointers that would later cause corruption. The fix is sound and the implementation is correct.

---

## Correctness Issues

None found. The patch correctly addresses a use-after-free scenario:

**Context**: `rte_mempool_get_bulk()` may partially fill the output array from cache before failing. The code was returning without restoring the guard pointers, leaving stale references to mbufs that are still owned by the mempool. These could be handed out to the application and then corrupted by CQE decompression.

**Fix**: The patch restores all `MLX5_VPMD_DESCS_PER_LOOP` guard slots to point to `&rxq->fake_mbuf` on allocation failure in both regular and MPRQ paths. This is correct because:
- The producer index (`elts_ci`) does not advance on failure, so the guard slots remain at the same array positions
- Restoring them ensures that any future CQE decompression writes target the dummy mbuf, not mbufs owned by the mempool or application
- The overhead is acceptable as this is the error path

---

## C Coding Style

All correct. The code follows DPDK style:
- Loop counter `i` properly declared and scoped
- Comment style matches DPDK conventions (multi-line block comment)
- Indentation and spacing consistent with surrounding code
- No forbidden tokens or patterns

---

## API and Documentation

**Warning** - Missing release notes entry:

This patch fixes a data corruption bug in the mlx5 PMD. While it correctly includes:
- `Fixes:` tag referencing the commit that introduced the vulnerability
- `Cc: stable at dpdk.org` for backporting
- Proper `.mailmap` update for the new contributor

It should also include a release notes entry in `doc/guides/rel_notes/release_XX_YY.rst` (where XX_YY is the current development release) under **Bug Fixes** section, something like:

```rst
* **net/mlx5: Fixed mbuf corruption on Rx replenish failure.**

  Restored fake mbuf guard pointers in vectorized Rx paths when
  mbuf allocation fails, preventing corruption of mbufs through
  stale pointers during CQE decompression.
```

---

## Additional Observations

**Info** - The loop could use `RTE_DIM()` for clarity, though the current form is acceptable:

```c
for (i = 0; i < RTE_DIM(((struct mlx5_rxq_data *)0)->fake_mbuf_vec); ++i)
```

However, since `MLX5_VPMD_DESCS_PER_LOOP` is the defined constant for this exact purpose throughout the vectorized Rx code, the current usage is consistent and more readable. No change needed.

---

## Conclusion

**Errors**: None

**Warnings**: 
- Missing release notes entry for a significant bug fix

**Recommendation**: Add release notes entry documenting this corruption fix, then the patch is ready to merge. The technical implementation is correct.