net/mana: fix CQE suppression handling on error completions
PATCH 1/1 net/mana: fix CQE suppression handling on error completions
On error CQEs (e.g. SA_DROP), the hardware generates one CQE per WQE regardless of the suppression flag. The previous code honored the suppress_tx_cqe flag unconditionally, which caused it to skip reading error CQEs and misalign the CQ consumer index.
This misalignment causes subsequent completions to be misinterpreted:
valid CQEs are read at wrong offsets, leading to spurious error counts, NULL packet frees, and potential use-after-free of mbufs that were already completed.
Check the CQE type before honoring suppression: only skip CQE reading when the completion is CQE_TX_OKAY.
--- drivers/net/mana/tx.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/mana/tx.c +4 -2
@@ -228,9 +228,11 @@ mana_tx_burst(void *dpdk_txq, struct rte_mbuf **tx_pkts, uint16_t nb_pkts) txq->gdma_sq.tail += desc->wqe_size_in_bu;/* If TX CQE suppression is used, don't read more CQE but move -* on to the next packet +* on to the next packet. On error CQEs, HW generates one CQE +* per WQE regardless of suppression, so always advance. */ -if (desc->suppress_tx_cqe) +if (desc->suppress_tx_cqe && + oob->cqe_hdr.cqe_type ==CQE_TX_OKAY )continue ; i++;
Signature · 1 line
2.43.0
Quoted 10 lines · On Wed, 25 Mar 2026 11:38:36 -0700 Long Li <[email protected]> wrote:
On error CQEs (e.g.
SA_DROP), the hardware generates one CQE per WQE regardless of the suppression flag. The previous code honored thesuppress_tx_cqeflag unconditionally, which caused it to skip reading error CQEs and misalign the CQ consumer index.This misalignment causes subsequent completions to be misinterpreted:
valid CQEs are read at wrong offsets, leading to spurious error counts, NULL packet frees, and potential use-after-free of mbufs that were already completed.
Quoted 7 lines
Check the CQE type before honoring suppression: only skip CQE reading when the completion is
CQE_TX_OKAY.Fixes cce2c9df44 ("net/mana: suppress Tx CQE generation whenever possible")Signed-off-by Long Li <[email protected]>
Applied but needed to use longer SHA for Fixes to meet current guidelines.
Quoted 23 lines
Subject: [EXTERNAL] Re: [PATCH] net/mana: fix CQE suppression handling on error completions
Quoted 17 lines · On Wed, 25 Mar 2026 11:38:36 -0700 Long Li <[email protected]> wrote:
On error CQEs (e.g.
SA_DROP), the hardware generates one CQE per WQE regardless of the suppression flag. The previous code honored thesuppress_tx_cqeflag unconditionally, which caused it to skip reading error CQEs and misalign the CQ consumer index.This misalignment causes subsequent completions to be misinterpreted:
valid CQEs are read at wrong offsets, leading to spurious error counts, NULL packet frees, and potential use-after-free of mbufs that were already completed.Check the CQE type before honoring suppression: only skip CQE reading when the completion is
CQE_TX_OKAY.Fixes cce2c9df44 ("net/mana: suppress Tx CQE generation wheneverpossible")
Cc: [email protected]
Quoted 6 lines
Quoted 1 line
Signed-off-by Long Li <[email protected]>Applied but needed to use longer SHA for Fixes to meet current guidelines.
Fixes cce2c9df4481 ("net/mana: suppress Tx CQE generation wheneverpossible")
Thank you!
Long