Re: [RFT 0/4] net/mlx5: fix several correctness bugs

Raslan Darawsheh
2026-03-01T10:33:57Z

Hi,

On 17/02/2026 5:04 PM, Stephen Hemminger wrote:
> Found these during a code review of the mlx5 driver. I don't have
> ConnectX hardware to test, so sending as RFC for maintainers to
> verify and test.
>
> Summary:
>
> 1/4 NULL pointer dereference in mlx5_txq_start() - txq_ctrl is
> dereferenced before the NULL check one line later.
>
> 2/4 DevX queue counter leak in hairpin counter setup - the
> counter object is not freed when the subsequent modify call
> fails.
>
> 3/4 Use-after-free in ASO age and CT management init - on queue
> init failure the management structure is freed but the
> pointer is not NULLed, so a retry dereferences freed memory.
>
> 4/4 64-bit counter truncation - uint64_t* cast to uint32_t*
> leaves the upper 32 bits uninitialised, producing wrong
> hairpin queue statistics.
>
> Stephen Hemminger (4):
> net/mlx5: fix NULL dereference in Tx queue start
> net/mlx5: fix counter leak in hairpin queue setup
> net/mlx5: fix use-after-free in ASO management init
> net/mlx5: fix counter truncation in queue counter read
>
> drivers/net/mlx5/mlx5.c | 13 ++++++++++++-
> drivers/net/mlx5/mlx5_trigger.c | 3 ++-
> 2 files changed, 14 insertions(+), 2 deletions(-)
>

Series applied to next-net-mlx,

Kindest regards
Raslan Darawsheh