From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 2F74746D7E; Thu, 21 Aug 2025 05:11:40 +0200 (CEST) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id C5BA840292; Thu, 21 Aug 2025 05:11:39 +0200 (CEST) Received: from inbox.dpdk.org (inbox.dpdk.org [95.142.172.178]) by mails.dpdk.org (Postfix) with ESMTP id CE7A94026C for ; Thu, 21 Aug 2025 05:11:37 +0200 (CEST) Received: by inbox.dpdk.org (Postfix, from userid 33) id A571646D80; Thu, 21 Aug 2025 05:11:37 +0200 (CEST) From: bugzilla@dpdk.org To: dev@dpdk.org Subject: [DPDK/ethdev Bug 1779] Packet segments do not get freed in mprq_buf_to_pkt() upon encountering MLX5_RXQ_CODE_NOMBUF Date: Thu, 21 Aug 2025 03:11:37 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: DPDK X-Bugzilla-Component: ethdev X-Bugzilla-Version: 22.11 X-Bugzilla-Keywords: X-Bugzilla-Severity: major X-Bugzilla-Who: canary.overflow@gmail.com X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Resolution: X-Bugzilla-Priority: Normal X-Bugzilla-Assigned-To: dev@dpdk.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter target_milestone Message-ID: Content-Type: multipart/alternative; boundary=17557458970.c3DfF50.1832711 Content-Transfer-Encoding: 7bit X-Bugzilla-URL: https://bugs.dpdk.org/ Auto-Submitted: auto-generated X-Auto-Response-Suppress: All MIME-Version: 1.0 X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org --17557458970.c3DfF50.1832711 Date: Thu, 21 Aug 2025 05:11:37 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.dpdk.org/ Auto-Submitted: auto-generated X-Auto-Response-Suppress: All https://bugs.dpdk.org/show_bug.cgi?id=3D1779 Bug ID: 1779 Summary: Packet segments do not get freed in mprq_buf_to_pkt() upon encountering MLX5_RXQ_CODE_NOMBUF Product: DPDK Version: 22.11 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: major Priority: Normal Component: ethdev Assignee: dev@dpdk.org Reporter: canary.overflow@gmail.com Target Milestone: --- drivers/net/mlx5/mlx5_rx.h mprq_buf_to_pkt(...): There are 2 issues:=20 - uint32_t seg_len =3D RTE_MIN(len, (uint32_t)(pkt->buf_len - RTE_PKTMBUF_HEADROOM)) seems unnecessary as to hit this code, len has to be greater than (uint32_t)(pkt->buf_len - RTE_PKTMBUF_HEADROOM) due to the if condition - If the allocation struct rte_mbuf *next =3D rte_pktmbuf_alloc(rxq->mp) fa= ils and packet has more than 2 segs, the segs that were allocated previously do= not get freed=20 mprq_buf_to_pkt(...) { ...=20=20=20=20=20=20=20=20 } else if (rxq->strd_scatter_en) { struct rte_mbuf *prev =3D pkt; uint32_t seg_len =3D RTE_MIN(len, (uint32_t) (pkt->buf_len - RTE_PKTMBUF_HEADROOM)); uint32_t rem_len =3D len - seg_len; rte_memcpy(rte_pktmbuf_mtod(pkt, void *), addr, seg_len); DATA_LEN(pkt) =3D seg_len; while (rem_len) { struct rte_mbuf *next =3D rte_pktmbuf_alloc(rxq->mp); if (unlikely(next =3D=3D NULL)) return MLX5_RXQ_CODE_NOMBUF; ... } ... } ... } Should rte_pktmbuf_free() be used instead? --=20 You are receiving this mail because: You are the assignee for the bug.= --17557458970.c3DfF50.1832711 Date: Thu, 21 Aug 2025 05:11:37 +0200 MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.dpdk.org/ Auto-Submitted: auto-generated X-Auto-Response-Suppress: All
Bug ID 1779
Summary Packet segments do not get freed in mprq_buf_to_pkt() upon en= countering MLX5_RXQ_CODE_NOMBUF
Product DPDK
Version 22.11
Hardware x86
OS Linux
Status UNCONFIRMED
Severity major
Priority Normal
Component ethdev
Assignee dev@dpdk.org
Reporter canary.overflow@gmail.com
Target Milestone --- 

drivers/net/mlx5/mlx5_rx.h mprq_bu=
f_to_pkt(...):

There are 2 issues:=20

- uint32_t seg_len =3D RTE_MIN(len, (uint32_t)(pkt->buf_len -
RTE_PKTMBUF_HEADROOM)) seems unnecessary as to hit this code, len has to be
greater than (uint32_t)(pkt->buf_len - RTE_PKTMBUF_HEADROOM) due to the =
if
condition

- If the allocation struct rte_mbuf *next =3D rte_pktmbuf_alloc(rxq->mp)=
 fails
and packet has more than 2 segs, the segs that were allocated previously do=
 not
get freed=20

    mprq_buf_to_pkt(...) {
        ...=20=20=20=20=20=20=20=20
        } else if (rxq->strd_scatter_en) {
            struct rte_mbuf *prev =3D pkt;
            uint32_t seg_len =3D RTE_MIN(len, (uint32_t)
            (pkt->buf_len - RTE_PKTMBUF_HEADROOM));
            uint32_t rem_len =3D len - seg_len;

            rte_memcpy(rte_pktmbuf_mtod(pkt, void *), addr, seg_len);
            DATA_LEN(pkt) =3D seg_len;
            while (rem_len) {
                struct rte_mbuf *next =3D rte_pktmbuf_alloc(rxq->mp);

                if (unlikely(next =3D=3D NULL))
                    return MLX5_RXQ_CODE_NOMBUF;
                ...
            }
            ...
        }
        ...
    }

Should rte_pktmbuf_free() be used instead?

You are receiving this mail because:
  • You are the assignee for the bug.
=20=20=20=20=20=20=20=20=20=20
= --17557458970.c3DfF50.1832711--