Skip to contentSkip to conversation

Fix CN20K mbuf size truncation

PATCH Applied Randy L Tice 5 participants 7 messages Sep 9 – Oct 16 Network drivers

lore
Share & tools
lore

Randy L Tice

author
#0 lore raw

cover Fix CN20K mbuf size truncation

This small fix prepares the CN20K inline security receive paths for mbuf layouts larger than 255 bytes.

The affected code recovers a packet mbuf by subtracting the size of struct rte_mbuf from a pointer stored in completion metadata. Keeping that size in an 8-bit local variable makes the recovery sensitive to future mbuf layout growth. The patch widens the local size variable without changing the surrounding fast-path logic.

The issue was found while preparing an unrelated mbuf layout extension.

Randy L Tice (1):
drivers: fix CN20K mbuf size truncation

 .mailmap                          | 1 +
 drivers/event/cnxk/cn20k_worker.h | 4 ++--
 drivers/net/cnxk/cn20k_rx.h       | 4 ++--
 3 files changed, 5 insertions(+), 4 deletions(-)
Signature · 1 line
2.35.6
author
#1 lore raw

PATCH 1/1 drivers: fix CN20K mbuf size truncation

CN20K inline security receive paths recover the packet mbuf by subtracting sizeof(struct rte_mbuf) from a pointer stored in completion metadata.

The size is currently kept in a uint8_t local variable before that subtraction. This truncates the value when the mbuf structure grows beyond 255 bytes, and can recover the wrong mbuf address.

Use a uint32_t local value for the mbuf byte size so larger mbuf layouts are handled correctly.

Fixes 5856f23129bb ("net/cnxk: support CN20K inline IPsec Rx")
Fixes edd0d5f3c299 ("event/cnxk: support CN20K inline IPsec Rx")
Cc [email protected]
Signed-off-by Randy L Tice <[email protected]>
---
 .mailmap                          | 1 +
 drivers/event/cnxk/cn20k_worker.h | 4 ++--
 drivers/net/cnxk/cn20k_rx.h       | 4 ++--
 3 files changed, 5 insertions(+), 4 deletions(-)
.mailmap +1 -0
index fcb3d1bb3f..2a8b54ea23 100644
@@ -1379,6 +1379,7 @@ Rakesh Kudurumalla <[email protected]> <[email protected]>
 Ralf Hoffmann <[email protected]>
 Rami Rosen <[email protected]> <[email protected]>
 Rami Rosen <[email protected]> <[email protected]>
+Randy L Tice <[email protected]>
 Randy Schacher <[email protected]>
 Rani Sharoni <[email protected]>
 Ranjit Menon <[email protected]>
drivers/event/cnxk/cn20k_worker.h +2 -2
index 6442113e09..5723a6eabb 100644
@@ -48,7 +48,7 @@ cn20k_process_vwqe(uintptr_t vwqe, uint16_t port_id, const uint32_t flags, struc
 {
 	uint64_t mbuf_init = 0x100010000ULL | RTE_PKTMBUF_HEADROOM;
 	struct cnxk_timesync_info *tstamp = ws->tstamp[port_id];
-	uint8_t m_sz = sizeof(struct rte_mbuf);
+	const uint32_t m_sz = sizeof(struct rte_mbuf);
 	void *lookup_mem = ws->lookup_mem;
 	uint64_t meta_aura = 0, laddr = 0;
 	uintptr_t lbase = ws->lmt_base;

@@ -165,7 +165,7 @@ cn20k_process_vwqe(uintptr_t vwqe, uint16_t port_id, const uint32_t flags, struc
 static __rte_always_inline void
 cn20k_sso_hws_post_process(struct cn20k_sso_hws *ws, uint64_t *u64, const uint32_t flags)
 {
-	uint8_t m_sz = sizeof(struct rte_mbuf);
+	const uint32_t m_sz = sizeof(struct rte_mbuf);
 	uintptr_t sa_base = 0;
 
 	u64[0] = (u64[0] & (0x3ull << 32)) << 6 | (u64[0] & (0x3FFull << 36)) << 4 |
drivers/net/cnxk/cn20k_rx.h +2 -2
index f8fa6de2b9..b544868c03 100644
@@ -702,7 +702,7 @@ cn20k_nix_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t pkts, co
 	uint64_t mbuf_init = rxq->mbuf_initializer;
 	const void *lookup_mem = rxq->lookup_mem;
 	const uint64_t data_off = rxq->data_off;
-	uint8_t m_sz = sizeof(struct rte_mbuf);
+	const uint32_t m_sz = sizeof(struct rte_mbuf);
 	const uint64_t wdata = rxq->wdata;
 	const uint32_t qmask = rxq->qmask;
 	const uintptr_t desc = rxq->desc;

@@ -815,7 +815,7 @@ cn20k_nix_flush_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t pk
 	uint64_t mbuf_init = rxq->mbuf_initializer;
 	const void *lookup_mem = rxq->lookup_mem;
 	const uint64_t data_off = rxq->data_off;
-	uint8_t m_sz = sizeof(struct rte_mbuf);
+	const uint32_t m_sz = sizeof(struct rte_mbuf);
 	const uint64_t wdata = rxq->wdata;
 	const uint32_t qmask = rxq->qmask;
 	const uintptr_t desc = rxq->desc;
Signature · 1 line
2.35.6
#2 lore raw

Re: [PATCH 1/1] drivers: fix CN20K mbuf size truncation

stop "cargo culting" use of always inline attribute. that attribute should only be used in special cases where code breaks compilation without it. it is not a go faster flag

Quoted 90 lines · On Wed, Sep 9, 2026, 09:06 Randy L Tice <[email protected]> wrote:

CN20K inline security receive paths recover the packet mbuf by subtracting sizeof(struct rte_mbuf) from a pointer stored in completion metadata.

The size is currently kept in a uint8_t local variable before that subtraction. This truncates the value when the mbuf structure grows beyond 255 bytes, and can recover the wrong mbuf address.

Use a uint32_t local value for the mbuf byte size so larger mbuf layouts are handled correctly.

Fixes 5856f23129bb ("net/cnxk: support CN20K inline IPsec Rx")
Fixes edd0d5f3c299 ("event/cnxk: support CN20K inline IPsec Rx")
Cc [email protected]
Signed-off-by Randy L Tice <[email protected]>
---
 .mailmap                          | 1 +
 drivers/event/cnxk/cn20k_worker.h | 4 ++--
 drivers/net/cnxk/cn20k_rx.h       | 4 ++--
 3 files changed, 5 insertions(+), 4 deletions(-)
.mailmap +0 -0
index fcb3d1bb3f..2a8b54ea23 100644
@@ -1379,6 +1379,7 @@ Rakesh Kudurumalla <[email protected]> <

[email protected]>
Ralf Hoffmann <[email protected]> Rami Rosen <[email protected]> <[email protected]> Rami Rosen <[email protected]> <[email protected]>

.mailmap +1 -0
+Randy L Tice <[email protected]>
 Randy Schacher <[email protected]>
 Rani Sharoni <[email protected]>
 Ranjit Menon <[email protected]>
drivers/event/cnxk/cn20k_worker.h +0 -0
index 6442113e09..5723a6eabb 100644
@@ -48,7 +48,7 @@ cn20k_process_vwqe(uintptr_t vwqe, uint16_t port_id,

const uint32_t flags, struc

 {
        uint64_t mbuf_init = 0x100010000ULL | RTE_PKTMBUF_HEADROOM;
        struct cnxk_timesync_info *tstamp = ws->tstamp[port_id];
drivers/event/cnxk/cn20k_worker.h +1 -1
-       uint8_t m_sz = sizeof(struct rte_mbuf);
+       const uint32_t m_sz = sizeof(struct rte_mbuf);
        void *lookup_mem = ws->lookup_mem;
        uint64_t meta_aura = 0, laddr = 0;
        uintptr_t lbase = ws->lmt_base;

@@ -165,7 +165,7 @@ cn20k_process_vwqe(uintptr_t vwqe, uint16_t port_id,

const uint32_t flags, struc
static __rte_always_inline void cn20k_sso_hws_post_process(struct cn20k_sso_hws *ws, uint64_t *u64, const
uint32_t flags)
{

drivers/event/cnxk/cn20k_worker.h +1 -1
-       uint8_t m_sz = sizeof(struct rte_mbuf);
+       const uint32_t m_sz = sizeof(struct rte_mbuf);
        uintptr_t sa_base = 0;
 
        u64[0] = (u64[0] & (0x3ull << 32)) << 6 | (u64[0] & (0x3FFull <<

36)) << 4 |

drivers/net/cnxk/cn20k_rx.h +1 -1
index f8fa6de2b9..b544868c03 100644
@@ -702,7 +702,7 @@ cn20k_nix_recv_pkts(void *rx_queue, struct rte_mbuf
 **rx_pkts, uint16_t pkts, co
        uint64_t mbuf_init = rxq->mbuf_initializer;
        const void *lookup_mem = rxq->lookup_mem;
        const uint64_t data_off = rxq->data_off;
-       uint8_t m_sz = sizeof(struct rte_mbuf);
+       const uint32_t m_sz = sizeof(struct rte_mbuf);
        const uint64_t wdata = rxq->wdata;
        const uint32_t qmask = rxq->qmask;

        const uintptr_t desc = rxq->desc;
drivers/net/cnxk/cn20k_rx.h +0 -0
@@ -815,7 +815,7 @@ cn20k_nix_flush_recv_pkts(void *rx_queue, struct

rte_mbuf **rx_pkts, uint16_t pk

        uint64_t mbuf_init = rxq->mbuf_initializer;
        const void *lookup_mem = rxq->lookup_mem;
        const uint64_t data_off = rxq->data_off;
drivers/net/cnxk/cn20k_rx.h +1 -2
-       uint8_t m_sz = sizeof(struct rte_mbuf);
+       const uint32_t m_sz = sizeof(struct rte_mbuf);
        const uint64_t wdata = rxq->wdata;
        const uint32_t qmask = rxq->qmask;
        const uintptr_t desc = rxq->desc;
--

2.35.6

#3 lore raw

RE: [PATCH 1/1] drivers: fix CN20K mbuf size truncation

There where there already.

The patch only changes the size of some local variables.

Venlig hilsen / Kind regards,

-Morten Brørup

From: Stephen Hemminger [mailto:[email protected]]
Sent: Wednesday, 9 September 2026 19.16
To: Randy L Tice
Cc: dev; stable; Thomas Monjalon; Pavan Nikhilesh; Shijith Thotton; Nithin Dabilpuram; Kiran Kumar K; Sunil Kumar Kori; Satha Rao; Harman Kalra; [email protected]
Subject: Re: [PATCH 1/1] drivers: fix CN20K mbuf size truncation

stop "cargo culting" use of always inline attribute. that attribute should only be used in special cases where code breaks compilation without it. it is not a go faster flag

On Wed, Sep 9, 2026, 09:06 Randy L Tice <[email protected]> wrote:

	CN20K inline security receive paths recover the packet mbuf by
	subtracting sizeof(struct rte_mbuf) from a pointer stored in
	completion metadata.
	
	The size is currently kept in a uint8_t local variable before
	that subtraction. This truncates the value when the mbuf structure
	grows beyond 255 bytes, and can recover the wrong mbuf address.
	
	Use a uint32_t local value for the mbuf byte size so larger mbuf
	layouts are handled correctly.
	
	Fixes: 5856f23129bb ("net/cnxk: support CN20K inline IPsec Rx")
	Fixes: edd0d5f3c299 ("event/cnxk: support CN20K inline IPsec Rx")
	Cc: [email protected]
	
	Signed-off-by: Randy L Tice <[email protected]>
	---
	 .mailmap                          | 1 +
	 drivers/event/cnxk/cn20k_worker.h | 4 ++--
	 drivers/net/cnxk/cn20k_rx.h       | 4 ++--
	 3 files changed, 5 insertions(+), 4 deletions(-)
	
	diff --git a/.mailmap b/.mailmap
	index fcb3d1bb3f..2a8b54ea23 100644
	--- a/.mailmap
	+++ b/.mailmap
	@@ -1379,6 +1379,7 @@ Rakesh Kudurumalla <[email protected]> <[email protected]>
	 Ralf Hoffmann <[email protected]>
	 Rami Rosen <[email protected]> <[email protected]>
	 Rami Rosen <[email protected]> <[email protected]>
	+Randy L Tice <[email protected]>
	 Randy Schacher <[email protected]>
	 Rani Sharoni <[email protected]>
	 Ranjit Menon <[email protected]>
	diff --git a/drivers/event/cnxk/cn20k_worker.h b/drivers/event/cnxk/cn20k_worker.h
	index 6442113e09..5723a6eabb 100644
	--- a/drivers/event/cnxk/cn20k_worker.h
	+++ b/drivers/event/cnxk/cn20k_worker.h
	@@ -48,7 +48,7 @@ cn20k_process_vwqe(uintptr_t vwqe, uint16_t port_id, const uint32_t flags, struc
	 {
	        uint64_t mbuf_init = 0x100010000ULL | RTE_PKTMBUF_HEADROOM;
	        struct cnxk_timesync_info *tstamp = ws->tstamp[port_id];
	-       uint8_t m_sz = sizeof(struct rte_mbuf);
	+       const uint32_t m_sz = sizeof(struct rte_mbuf);
	        void *lookup_mem = ws->lookup_mem;
	        uint64_t meta_aura = 0, laddr = 0;
	        uintptr_t lbase = ws->lmt_base;
	@@ -165,7 +165,7 @@ cn20k_process_vwqe(uintptr_t vwqe, uint16_t port_id, const uint32_t flags, struc
	 static __rte_always_inline void
	 cn20k_sso_hws_post_process(struct cn20k_sso_hws *ws, uint64_t *u64, const uint32_t flags)
	 {
	-       uint8_t m_sz = sizeof(struct rte_mbuf);
	+       const uint32_t m_sz = sizeof(struct rte_mbuf);
	        uintptr_t sa_base = 0;
	
	        u64[0] = (u64[0] & (0x3ull << 32)) << 6 | (u64[0] & (0x3FFull << 36)) << 4 |
	diff --git a/drivers/net/cnxk/cn20k_rx.h b/drivers/net/cnxk/cn20k_rx.h
	index f8fa6de2b9..b544868c03 100644
	--- a/drivers/net/cnxk/cn20k_rx.h
	+++ b/drivers/net/cnxk/cn20k_rx.h
	@@ -702,7 +702,7 @@ cn20k_nix_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t pkts, co
	        uint64_t mbuf_init = rxq->mbuf_initializer;
	        const void *lookup_mem = rxq->lookup_mem;
	        const uint64_t data_off = rxq->data_off;
	-       uint8_t m_sz = sizeof(struct rte_mbuf);
	+       const uint32_t m_sz = sizeof(struct rte_mbuf);
	        const uint64_t wdata = rxq->wdata;
	        const uint32_t qmask = rxq->qmask;
	        const uintptr_t desc = rxq->desc;
	@@ -815,7 +815,7 @@ cn20k_nix_flush_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t pk
	        uint64_t mbuf_init = rxq->mbuf_initializer;
	        const void *lookup_mem = rxq->lookup_mem;
	        const uint64_t data_off = rxq->data_off;
	-       uint8_t m_sz = sizeof(struct rte_mbuf);
	+       const uint32_t m_sz = sizeof(struct rte_mbuf);
	        const uint64_t wdata = rxq->wdata;
	        const uint32_t qmask = rxq->qmask;
	        const uintptr_t desc = rxq->desc;
	-- 
	2.35.6
#4 lore raw

Re: [PATCH 1/1] drivers: fix CN20K mbuf size truncation

Quoted 3 lines · On Wed, 9 Sep 2026 20:18:02 +0200 Morten Brørup <[email protected]>…

There where there already.

The patch only changes the size of some local variables.

Agreed, I am going to do a tree wide fix of this.

Acked-by on v1 1/1
#5 lore raw

Re: [PATCH 1/1] drivers: fix CN20K mbuf size truncation

In reply to Randy L Tice
Acked-by Nithin Dabilpuram <[email protected]>
Quoted 82 lines · Randy L Tice

CN20K inline security receive paths recover the packet mbuf by subtracting sizeof(struct rte_mbuf) from a pointer stored in completion metadata.

The size is currently kept in a uint8_t local variable before that subtraction. This truncates the value when the mbuf structure grows beyond 255 bytes, and can recover the wrong mbuf address.

Use a uint32_t local value for the mbuf byte size so larger mbuf layouts are handled correctly.

Fixes 5856f23129bb ("net/cnxk: support CN20K inline IPsec Rx")
Fixes edd0d5f3c299 ("event/cnxk: support CN20K inline IPsec Rx")
Cc [email protected]
Signed-off-by Randy L Tice <[email protected]>
---
 .mailmap                          | 1 +
 drivers/event/cnxk/cn20k_worker.h | 4 ++--
 drivers/net/cnxk/cn20k_rx.h       | 4 ++--
 3 files changed, 5 insertions(+), 4 deletions(-)
.mailmap +1 -0
index fcb3d1bb3f..2a8b54ea23 100644
@@ -1379,6 +1379,7 @@ Rakesh Kudurumalla <[email protected]> <[email protected]>
 Ralf Hoffmann <[email protected]>
 Rami Rosen <[email protected]> <[email protected]>
 Rami Rosen <[email protected]> <[email protected]>
+Randy L Tice <[email protected]>
 Randy Schacher <[email protected]>
 Rani Sharoni <[email protected]>
 Ranjit Menon <[email protected]>
drivers/event/cnxk/cn20k_worker.h +2 -2
index 6442113e09..5723a6eabb 100644
@@ -48,7 +48,7 @@ cn20k_process_vwqe(uintptr_t vwqe, uint16_t port_id, const uint32_t flags, struc
 {
        uint64_t mbuf_init = 0x100010000ULL | RTE_PKTMBUF_HEADROOM;
        struct cnxk_timesync_info *tstamp = ws->tstamp[port_id];
-       uint8_t m_sz = sizeof(struct rte_mbuf);
+       const uint32_t m_sz = sizeof(struct rte_mbuf);
        void *lookup_mem = ws->lookup_mem;
        uint64_t meta_aura = 0, laddr = 0;
        uintptr_t lbase = ws->lmt_base;

@@ -165,7 +165,7 @@ cn20k_process_vwqe(uintptr_t vwqe, uint16_t port_id, const uint32_t flags, struc
 static __rte_always_inline void
 cn20k_sso_hws_post_process(struct cn20k_sso_hws *ws, uint64_t *u64, const uint32_t flags)
 {
-       uint8_t m_sz = sizeof(struct rte_mbuf);
+       const uint32_t m_sz = sizeof(struct rte_mbuf);
        uintptr_t sa_base = 0;
 
        u64[0] = (u64[0] & (0x3ull << 32)) << 6 | (u64[0] & (0x3FFull << 36)) << 4 |
drivers/net/cnxk/cn20k_rx.h +2 -3
index f8fa6de2b9..b544868c03 100644
@@ -702,7 +702,7 @@ cn20k_nix_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t pkts, co
        uint64_t mbuf_init = rxq->mbuf_initializer;
        const void *lookup_mem = rxq->lookup_mem;
        const uint64_t data_off = rxq->data_off;
-       uint8_t m_sz = sizeof(struct rte_mbuf);
+       const uint32_t m_sz = sizeof(struct rte_mbuf);
        const uint64_t wdata = rxq->wdata;
        const uint32_t qmask = rxq->qmask;
        const uintptr_t desc = rxq->desc;

@@ -815,7 +815,7 @@ cn20k_nix_flush_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t pk
        uint64_t mbuf_init = rxq->mbuf_initializer;
        const void *lookup_mem = rxq->lookup_mem;
        const uint64_t data_off = rxq->data_off;
-       uint8_t m_sz = sizeof(struct rte_mbuf);
+       const uint32_t m_sz = sizeof(struct rte_mbuf);
        const uint64_t wdata = rxq->wdata;
        const uint32_t qmask = rxq->qmask;
        const uintptr_t desc = rxq->desc;
--

2.35.6

Applied
#6 lore raw

Re: [PATCH 1/1] drivers: fix CN20K mbuf size truncation

Quoted 2 lines · Nithin Dabilpuram
Acked-by Nithin Dabilpuram <[email protected]>

Applied to dpdk-next-net-mrvl/for-main. Thanks

Quoted 84 lines · Randy L Tice
Quoted 82 lines

CN20K inline security receive paths recover the packet mbuf by subtracting sizeof(struct rte_mbuf) from a pointer stored in completion metadata.

The size is currently kept in a uint8_t local variable before that subtraction. This truncates the value when the mbuf structure grows beyond 255 bytes, and can recover the wrong mbuf address.

Use a uint32_t local value for the mbuf byte size so larger mbuf layouts are handled correctly.

Fixes 5856f23129bb ("net/cnxk: support CN20K inline IPsec Rx")
Fixes edd0d5f3c299 ("event/cnxk: support CN20K inline IPsec Rx")
Cc [email protected]
Signed-off-by Randy L Tice <[email protected]>
---
 .mailmap                          | 1 +
 drivers/event/cnxk/cn20k_worker.h | 4 ++--
 drivers/net/cnxk/cn20k_rx.h       | 4 ++--
 3 files changed, 5 insertions(+), 4 deletions(-)
.mailmap +1 -0
index fcb3d1bb3f..2a8b54ea23 100644
@@ -1379,6 +1379,7 @@ Rakesh Kudurumalla <[email protected]> <[email protected]>
 Ralf Hoffmann <[email protected]>
 Rami Rosen <[email protected]> <[email protected]>
 Rami Rosen <[email protected]> <[email protected]>
+Randy L Tice <[email protected]>
 Randy Schacher <[email protected]>
 Rani Sharoni <[email protected]>
 Ranjit Menon <[email protected]>
drivers/event/cnxk/cn20k_worker.h +2 -2
index 6442113e09..5723a6eabb 100644
@@ -48,7 +48,7 @@ cn20k_process_vwqe(uintptr_t vwqe, uint16_t port_id, const uint32_t flags, struc
 {
        uint64_t mbuf_init = 0x100010000ULL | RTE_PKTMBUF_HEADROOM;
        struct cnxk_timesync_info *tstamp = ws->tstamp[port_id];
-       uint8_t m_sz = sizeof(struct rte_mbuf);
+       const uint32_t m_sz = sizeof(struct rte_mbuf);
        void *lookup_mem = ws->lookup_mem;
        uint64_t meta_aura = 0, laddr = 0;
        uintptr_t lbase = ws->lmt_base;

@@ -165,7 +165,7 @@ cn20k_process_vwqe(uintptr_t vwqe, uint16_t port_id, const uint32_t flags, struc
 static __rte_always_inline void
 cn20k_sso_hws_post_process(struct cn20k_sso_hws *ws, uint64_t *u64, const uint32_t flags)
 {
-       uint8_t m_sz = sizeof(struct rte_mbuf);
+       const uint32_t m_sz = sizeof(struct rte_mbuf);
        uintptr_t sa_base = 0;
 
        u64[0] = (u64[0] & (0x3ull << 32)) << 6 | (u64[0] & (0x3FFull << 36)) << 4 |
drivers/net/cnxk/cn20k_rx.h +2 -3
index f8fa6de2b9..b544868c03 100644
@@ -702,7 +702,7 @@ cn20k_nix_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t pkts, co
        uint64_t mbuf_init = rxq->mbuf_initializer;
        const void *lookup_mem = rxq->lookup_mem;
        const uint64_t data_off = rxq->data_off;
-       uint8_t m_sz = sizeof(struct rte_mbuf);
+       const uint32_t m_sz = sizeof(struct rte_mbuf);
        const uint64_t wdata = rxq->wdata;
        const uint32_t qmask = rxq->qmask;
        const uintptr_t desc = rxq->desc;

@@ -815,7 +815,7 @@ cn20k_nix_flush_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t pk
        uint64_t mbuf_init = rxq->mbuf_initializer;
        const void *lookup_mem = rxq->lookup_mem;
        const uint64_t data_off = rxq->data_off;
-       uint8_t m_sz = sizeof(struct rte_mbuf);
+       const uint32_t m_sz = sizeof(struct rte_mbuf);
        const uint64_t wdata = rxq->wdata;
        const uint32_t qmask = rxq->qmask;
        const uintptr_t desc = rxq->desc;
--

2.35.6