[PATCH 1/1] drivers: fix CN20K mbuf size truncation
From: Randy L Tice <hidden>
Date: 2026-09-09 16:06:50
Subsystem:
networking drivers, the rest · Maintainers:
Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
CN20K inline security receive paths recover the packet mbuf by
subtracting sizeof(struct rte_mbuf) from a pointer stored in
completion metadata.
The size is currently kept in a uint8_t local variable before
that subtraction. This truncates the value when the mbuf structure
grows beyond 255 bytes, and can recover the wrong mbuf address.
Use a uint32_t local value for the mbuf byte size so larger mbuf
layouts are handled correctly.
Fixes: 5856f23129bb ("net/cnxk: support CN20K inline IPsec Rx")
Fixes: edd0d5f3c299 ("event/cnxk: support CN20K inline IPsec Rx")
Cc: stable@dpdk.org
Signed-off-by: Randy L Tice <redacted>
---
.mailmap | 1 +
drivers/event/cnxk/cn20k_worker.h | 4 ++--
drivers/net/cnxk/cn20k_rx.h | 4 ++--
3 files changed, 5 insertions(+), 4 deletions(-)
diff --git a/.mailmap b/.mailmap
index fcb3d1bb3f..2a8b54ea23 100644
--- a/.mailmap
+++ b/.mailmap@@ -1379,6 +1379,7 @@ Rakesh Kudurumalla <rkudurumalla@marvell.com> <rkudurumalla@caviumnetworks.com> Ralf Hoffmann <ralf.hoffmann@allegro-packets.com> Rami Rosen <ramirose@gmail.com> <rami.rosen@intel.com> Rami Rosen <ramirose@gmail.com> <roszenrami@gmail.com> +Randy L Tice <rtice@cisco.com> Randy Schacher <stuart.schacher@broadcom.com> Rani Sharoni <ranish@nvidia.com> Ranjit Menon <ranjit.menon@intel.com>
diff --git a/drivers/event/cnxk/cn20k_worker.h b/drivers/event/cnxk/cn20k_worker.h
index 6442113e09..5723a6eabb 100644
--- a/drivers/event/cnxk/cn20k_worker.h
+++ b/drivers/event/cnxk/cn20k_worker.h@@ -48,7 +48,7 @@ cn20k_process_vwqe(uintptr_t vwqe, uint16_t port_id, const uint32_t flags, struc { uint64_t mbuf_init = 0x100010000ULL | RTE_PKTMBUF_HEADROOM; struct cnxk_timesync_info *tstamp = ws->tstamp[port_id]; - uint8_t m_sz = sizeof(struct rte_mbuf); + const uint32_t m_sz = sizeof(struct rte_mbuf); void *lookup_mem = ws->lookup_mem; uint64_t meta_aura = 0, laddr = 0; uintptr_t lbase = ws->lmt_base;
@@ -165,7 +165,7 @@ cn20k_process_vwqe(uintptr_t vwqe, uint16_t port_id, const uint32_t flags, struc static __rte_always_inline void cn20k_sso_hws_post_process(struct cn20k_sso_hws *ws, uint64_t *u64, const uint32_t flags) { - uint8_t m_sz = sizeof(struct rte_mbuf); + const uint32_t m_sz = sizeof(struct rte_mbuf); uintptr_t sa_base = 0; u64[0] = (u64[0] & (0x3ull << 32)) << 6 | (u64[0] & (0x3FFull << 36)) << 4 |
diff --git a/drivers/net/cnxk/cn20k_rx.h b/drivers/net/cnxk/cn20k_rx.h
index f8fa6de2b9..b544868c03 100644
--- a/drivers/net/cnxk/cn20k_rx.h
+++ b/drivers/net/cnxk/cn20k_rx.h@@ -702,7 +702,7 @@ cn20k_nix_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t pkts, co uint64_t mbuf_init = rxq->mbuf_initializer; const void *lookup_mem = rxq->lookup_mem; const uint64_t data_off = rxq->data_off; - uint8_t m_sz = sizeof(struct rte_mbuf); + const uint32_t m_sz = sizeof(struct rte_mbuf); const uint64_t wdata = rxq->wdata; const uint32_t qmask = rxq->qmask; const uintptr_t desc = rxq->desc;
@@ -815,7 +815,7 @@ cn20k_nix_flush_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t pk uint64_t mbuf_init = rxq->mbuf_initializer; const void *lookup_mem = rxq->lookup_mem; const uint64_t data_off = rxq->data_off; - uint8_t m_sz = sizeof(struct rte_mbuf); + const uint32_t m_sz = sizeof(struct rte_mbuf); const uint64_t wdata = rxq->wdata; const uint32_t qmask = rxq->qmask; const uintptr_t desc = rxq->desc;
--
2.35.6