Re: [PATCH 06/14] common/cnxk: fix null deref and irq ack in CPT CQ handler

[Stephen Hemminger <stephen@networkplumber.org>]

On Thu, 17 Sep 2026 12:40:08 +0530
Rahul Bhansali <rbhansali@marvell.com> wrote:

> From: Aarnav JP <ajp@marvell.com>
> 
> The CPT CQ interrupt handler (nix_inl_cpt_cq_cb) unconditionally
> dereferences lf->dev->roc_nix to obtain roc_nix, nix, and port_id.
> For inbound, the CPT LF belongs to the inline device which is not
> an ethdev, so roc_nix is NULL and the dereference crashes.
> 
> Additionally, error paths returned without writing CPT_LF_DONE_ACK,
> leaving CQ entries unacknowledged causing the completion queue to
> fill up.
> 
> Fix by deferring roc_nix/nix/port_id derivation into the outbound
> branch where roc_nix is valid, setting port_id to UINT32_MAX for
> inbound, and routing all error paths through a common cq_ack label
> that drains entries and writes CPT_LF_DONE_ACK.
> 
> Fixes: 3fdf3e53f3c4 ("common/cnxk: enable CPT CQ for inline IPsec inbound")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Aarnav JP <ajp@marvell.com>
> ---

More detailed AI review:

Patch 6/14 common/cnxk: fix null deref and irq ack in CPT CQ handler
-------------------------------------------------------------------
Info: at cq_ack,
  head = (lf->cq_head + count) % lf->cq_size;
overwrites the head the loop already computed on the normal path.
It is only needed for the early gotos.