[RFT 1/4] net/mlx5: fix NULL dereference in Tx queue start

Stephen Hemminger
2026-02-17T15:06:51Z

mlx5_txq_get() can return NULL for an unconfigured queue index,
but the result is dereferenced to initialise txq_data before the
NULL check on the following line. Move the txq_data assignment
after the NULL guard.

Fixes: 6f356d3840e6 ("net/mlx5: pass DevX object info in Tx queue start")
Cc: stable@dpdk.org

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
drivers/net/mlx5/mlx5_trigger.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/mlx5/mlx5_trigger.c b/drivers/net/mlx5/mlx5_trigger.c
index f155b1a7a0..a070aaecfd 100644
--- a/drivers/net/mlx5/mlx5_trigger.c
+++ b/drivers/net/mlx5/mlx5_trigger.c
@@ -59,10 +59,11 @@ mlx5_txq_start(struct rte_eth_dev *dev)
for (cnt = log_max_wqe; cnt > 0; cnt -= 1) {
for (i = 0; i != priv->txqs_n; ++i) {
struct mlx5_txq_ctrl *txq_ctrl = mlx5_txq_get(dev, i);
- struct mlx5_txq_data *txq_data = &txq_ctrl->txq;
+ struct mlx5_txq_data *txq_data;

if (!txq_ctrl)
continue;
+ txq_data = &txq_ctrl->txq;
if (txq_data->elts_n != cnt) {
mlx5_txq_release(dev, i);
continue;
--
2.51.0