[RFT 0/4] net/mlx5: fix several correctness bugs

Stephen Hemminger
2026-02-17T15:06:45Z

Found these during a code review of the mlx5 driver. I don't have
ConnectX hardware to test, so sending as RFC for maintainers to
verify and test.

Summary:

1/4 NULL pointer dereference in mlx5_txq_start() - txq_ctrl is
dereferenced before the NULL check one line later.

2/4 DevX queue counter leak in hairpin counter setup - the
counter object is not freed when the subsequent modify call
fails.

3/4 Use-after-free in ASO age and CT management init - on queue
init failure the management structure is freed but the
pointer is not NULLed, so a retry dereferences freed memory.

4/4 64-bit counter truncation - uint64_t* cast to uint32_t*
leaves the upper 32 bits uninitialised, producing wrong
hairpin queue statistics.

Stephen Hemminger (4):
net/mlx5: fix NULL dereference in Tx queue start
net/mlx5: fix counter leak in hairpin queue setup
net/mlx5: fix use-after-free in ASO management init
net/mlx5: fix counter truncation in queue counter read

drivers/net/mlx5/mlx5.c | 13 ++++++++++++-
drivers/net/mlx5/mlx5_trigger.c | 3 ++-
2 files changed, 14 insertions(+), 2 deletions(-)

--
2.51.0