On Fri, Jun 12, 2026 at 02:35:31PM +0000, Ciara Loftus wrote:
> When hardware CRC stripping is active, a frame whose on-wire size is an
> exact multiple of the Rx buffer size can cause the NIC to fill the final
> data descriptor and place the four CRC bytes into a separate trailing
> descriptor. After hardware stripping, that descriptor carries zero bytes
> of payload.
>
> The existing CRC cleanup code only handles a zero-length trailing segment
> when software CRC stripping is enabled. When hardware stripping is
> active, the zero-length mbuf is silently chained to the reassembled
> packet. Forwarding such a packet causes a zero-length Tx descriptor,
> triggering a Malicious Driver Detection event on the PF and resetting
> the VF.
>
> Fix by adding logic to detect a zero-length final segment when hardware
> CRC stripping is active, and freeing it.
>
> Fixes: a2b29a7733ef ("net/avf: enable basic Rx Tx")
> Fixes: b8b4c54ef9b0 ("net/iavf: support flexible Rx descriptor in normal
> path")
> Cc: [email protected]
>
> Signed-off-by: Declan Doherty <[email protected]>
> Signed-off-by: Ciara Loftus <[email protected]>
> ---
> drivers/net/intel/iavf/iavf_rxtx.c | 16 ++++++++++++++++
> 1 file changed, 16 insertions(+)
>
> diff --git a/drivers/net/intel/iavf/iavf_rxtx.c
> b/drivers/net/intel/iavf/iavf_rxtx.c
> index a57af7faed..86ebb2618d 100644
> --- a/drivers/net/intel/iavf/iavf_rxtx.c
> +++ b/drivers/net/intel/iavf/iavf_rxtx.c
> @@ -1716,6 +1716,14 @@ iavf_recv_scattered_pkts_flex_rxd(void *rx_queue,
> struct rte_mbuf **rx_pkts,
> rxm->data_len = (uint16_t)(rx_packet_len -
> RTE_ETHER_CRC_LEN);
> }
> + } else if (unlikely(rx_packet_len == 0)) {
> + /*
> + * NIC split CRC bytes into a trailing segment which is
> + * now empty after hardware CRC stripping. Free it.
> + */
> + rte_pktmbuf_free_seg(rxm);
> + first_seg->nb_segs--;
> + last_seg->next = NULL;
> }
>
The vector paths also handle scattered packets (via reassembly). Do they
need a fix for this? What about the other drivers that work on the PF, such
as ice/i40e?
/Bruce
> first_seg->port = rxq->port_id;
> @@ -1884,6 +1892,14 @@ iavf_recv_scattered_pkts(void *rx_queue, struct
> rte_mbuf **rx_pkts,
> } else
> rxm->data_len = (uint16_t)(rx_packet_len -
> RTE_ETHER_CRC_LEN);
> + } else if (unlikely(rx_packet_len == 0)) {
> + /*
> + * NIC split CRC bytes into a trailing segment which is
> + * now empty after hardware CRC stripping. Free it.
> + */
> + rte_pktmbuf_free_seg(rxm);
> + first_seg->nb_segs--;
> + last_seg->next = NULL;
> }
>
> first_seg->port = rxq->port_id;
> --
> 2.43.0
>
