On Mon, May 11, 2026 at 02:39:32PM +0530, Shaiq Wani wrote:
> In split queue mode the completion queue (rxq) does not own the mbuf
> pool — the buffer queue (bufq2) does. The mbuf initializer encodes
> the mempool pointer, refcount and other per-pool mbuf metadata that
> is stamped into every received mbuf during rearm.
>
> Using queue->mbuf initializer reads an uninitialised or zero value
> from the completion queue, corrupting every mbuf rearm. Use
> queue->bufq2->mbuf initializer to get the correct value from the
> buffer queue that actually owns the mbufs.
>
> Fixes: 1f065f9d75ff ("net/idpf: add AVX2 Rx path for split queue config")
> Signed-off-by: Shaiq Wani <[email protected]>
Acked-by: Bruce Richardson <[email protected]>
> ---
> drivers/net/intel/idpf/idpf_common_rxtx_avx2.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/intel/idpf/idpf_common_rxtx_avx2.c
> b/drivers/net/intel/idpf/idpf_common_rxtx_avx2.c
> index 28d4246134..d3a8e17778 100644
> --- a/drivers/net/intel/idpf/idpf_common_rxtx_avx2.c
> +++ b/drivers/net/intel/idpf/idpf_common_rxtx_avx2.c
> @@ -491,7 +491,7 @@ idpf_dp_splitq_recv_pkts_avx2(void *rxq, struct rte_mbuf
> **rx_pkts, uint16_t nb_
> struct rte_mbuf **sw_ring = &queue->bufq2->sw_ring[queue->rx_tail];
> volatile union virtchnl2_rx_desc *rxdp =
> (volatile union virtchnl2_rx_desc *)queue->rx_ring +
> queue->rx_tail;
> - const __m256i mbuf_init = _mm256_set_epi64x(0, 0, 0,
> queue->mbuf_initializer);
> + const __m256i mbuf_init = _mm256_set_epi64x(0, 0, 0,
> queue->bufq2->mbuf_initializer);
> uint64_t head_gen;
> uint16_t received = 0;
> int i;
> --
> 2.34.1
>
