[PATCH] net/mlx5: fix uint16 underflow on Rx queue error path

[PATCH] net/mlx5: fix uint16 underflow on Rx queue error path

[Maayan Kashani]

Avoid post-decrementing the segment index when it is zero in the
error cleanup path of mlx5_rxq_mempool_register().

Coverity issue: 503770
Fixes: 8d1cb02da5b7 ("net/mlx5: support selective Rx")
Cc: stable@dpdk.org

Signed-off-by: Maayan Kashani <mkashani@nvidia.com>
---
 drivers/net/mlx5/mlx5_trigger.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/net/mlx5/mlx5_trigger.c b/drivers/net/mlx5/mlx5_trigger.c
index c2804c58974..b6ce0133c93 100644
--- a/drivers/net/mlx5/mlx5_trigger.c
+++ b/drivers/net/mlx5/mlx5_trigger.c
@@ -187,10 +187,13 @@ mlx5_rxq_mempool_register(struct mlx5_rxq_ctrl *rxq_ctrl)
 	return 0;
 
 error:
-	while (s-- > 0) {
+	while (s > 0) {
+		s--;
 		seg = &rxq_ctrl->rxq.rxseg[s];
-		mlx5_free(seg->null_mbuf);
-		seg->null_mbuf = NULL;
+		if (!seg->mp) {
+			mlx5_free(seg->null_mbuf);
+			seg->null_mbuf = NULL;
+		}
 	}
 	return ret;
 }
-- 
2.21.0

[PATCH v2] net/mlx5: fix uint16 underflow on Rx queue error path

[Maayan Kashani]

Avoid post-decrementing the segment index when it is zero in the
error cleanup path of mlx5_rxq_mempool_register().

Coverity issue: 503770
Fixes: 8d1cb02da5b7 ("net/mlx5: support selective Rx")
Cc: stable@dpdk.org

Signed-off-by: Maayan Kashani <mkashani@nvidia.com>
---
 drivers/net/mlx5/mlx5_trigger.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/net/mlx5/mlx5_trigger.c b/drivers/net/mlx5/mlx5_trigger.c
index 25847c8ba2e..25bb448a708 100644
--- a/drivers/net/mlx5/mlx5_trigger.c
+++ b/drivers/net/mlx5/mlx5_trigger.c
@@ -187,10 +187,13 @@ mlx5_rxq_mempool_register(struct mlx5_rxq_ctrl *rxq_ctrl)
 	return 0;
 
 error:
-	while (s-- > 0) {
+	while (s > 0) {
+		s--;
 		seg = &rxq_ctrl->rxq.rxseg[s];
-		mlx5_free(seg->null_mbuf);
-		seg->null_mbuf = NULL;
+		if (seg->mp == NULL) {
+			mlx5_free(seg->null_mbuf);
+			seg->null_mbuf = NULL;
+		}
 	}
 	return ret;
 }
-- 
2.21.0

RE: [PATCH v2] net/mlx5: fix uint16 underflow on Rx queue error path

[Bing Zhao]

Hi,

> -----Original Message-----
> From: Maayan Kashani <mkashani@nvidia.com>
> Sent: Sunday, August 9, 2026 5:49 PM
> To: dev@dpdk.org
> Cc: Maayan Kashani <mkashani@nvidia.com>; Raslan Darawsheh
> <rasland@nvidia.com>; stable@dpdk.org; Dariusz Sosnowski
> <dsosnowski@nvidia.com>; Slava Ovsiienko <viacheslavo@nvidia.com>; Bing
> Zhao <bingz@nvidia.com>; Ori Kam <orika@nvidia.com>; Suanming Mou
> <suanmingm@nvidia.com>; Matan Azrad <matan@nvidia.com>; NBU-Contact-Thomas
> Monjalon (EXTERNAL) <thomas@monjalon.net>; Gregory Etelson
> <getelson@nvidia.com>
> Subject: [PATCH v2] net/mlx5: fix uint16 underflow on Rx queue error path
> 
> Avoid post-decrementing the segment index when it is zero in the error
> cleanup path of mlx5_rxq_mempool_register().
> 
> Coverity issue: 503770
> Fixes: 8d1cb02da5b7 ("net/mlx5: support selective Rx")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Maayan Kashani <mkashani@nvidia.com>
> ---
>  drivers/net/mlx5/mlx5_trigger.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/net/mlx5/mlx5_trigger.c
> b/drivers/net/mlx5/mlx5_trigger.c index 25847c8ba2e..25bb448a708 100644
> --- a/drivers/net/mlx5/mlx5_trigger.c
> +++ b/drivers/net/mlx5/mlx5_trigger.c
> @@ -187,10 +187,13 @@ mlx5_rxq_mempool_register(struct mlx5_rxq_ctrl
> *rxq_ctrl)
>  	return 0;
> 
>  error:
> -	while (s-- > 0) {
> +	while (s > 0) {
> +		s--;
>  		seg = &rxq_ctrl->rxq.rxseg[s];
> -		mlx5_free(seg->null_mbuf);
> -		seg->null_mbuf = NULL;
> +		if (seg->mp == NULL) {
> +			mlx5_free(seg->null_mbuf);
> +			seg->null_mbuf = NULL;
> +		}
>  	}
>  	return ret;
>  }
> --
> 2.21.0

Acked-by: Bing Zhao <bingz@nvidia.com>

Re: [PATCH v2] net/mlx5: fix uint16 underflow on Rx queue error path

[Stephen Hemminger]

On Sun, 9 Aug 2026 12:48:37 +0300
Maayan Kashani <mkashani@nvidia.com> wrote:

> Avoid post-decrementing the segment index when it is zero in the
> error cleanup path of mlx5_rxq_mempool_register().
> 
> Coverity issue: 503770
> Fixes: 8d1cb02da5b7 ("net/mlx5: support selective Rx")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Maayan Kashani <mkashani@nvidia.com>
> ---

Claude Opus AI review sees dead bodies here...

Review of [PATCH v2] net/mlx5: fix uint16 underflow on Rx queue error path

Warning: undocumented second change, and it is dead code

  The commit message describes only the loop restructuring, but the patch
  also adds a "seg->mp == NULL" guard around the free:

  +		if (seg->mp == NULL) {
  +			mlx5_free(seg->null_mbuf);
  +			seg->null_mbuf = NULL;
  +		}

  This guard can never be false for a segment that has a null_mbuf.
  seg->null_mbuf is only ever assigned in the mp == NULL branch of the
  registration loop (mlx5_trigger.c:179), and rxq_ctrl is allocated with
  MLX5_MEM_ZERO (mlx5_rxq.c:1881), so a segment with mp != NULL always has
  null_mbuf == NULL. mlx5_free() already returns early on NULL
  (drivers/common/mlx5/mlx5_malloc.c:275), so the guard changes nothing.

  It also makes this cleanup inconsistent with rxq_free_elts_sprq(),
  which frees null_mbuf for every segment unconditionally:

	for (i = 0; i < rxq->rxseg_n; i++) {
		mlx5_free(rxq->rxseg[i].null_mbuf);
		rxq->rxseg[i].null_mbuf = NULL;
	}

  Suggest dropping the guard so the patch does only what its subject says.
  If it is deliberate, say why in the commit message and apply the same
  rule in mlx5_rxq.c so the two paths agree.

Info: the underflow has no observable effect

  In the original "while (s-- > 0)", s is uint16_t and the comparison uses
  the value before the decrement. With s == 0 the body never executes; s
  wraps to 0xFFFF but is dead from that point on, so there is no
  out-of-bounds index and no misbehaviour. Coverity 503770 is reporting the
  wrap of a dead local. The rewrite is behaviour-preserving and fine, but
  it would help stable maintainers to state in the commit message that this
  is a static-analysis fix with no runtime impact.

Info: no v2 changelog after the "---" separator, so what changed since
  20260730135620.213682-1-mkashani@nvidia.com is not visible to reviewers.