[bug report] net/mlx5e: Implement PSP Tx data path

[bug report] net/mlx5e: Implement PSP Tx data path

[Dan Carpenter]

Hello Raed Salem,

Commit e5a1861a298e ("net/mlx5e: Implement PSP Tx data path") from
Sep 16, 2025 (linux-next), leads to the following Smatch static
checker warning:

    drivers/net/ethernet/mellanox/mlx5/core/en_tx.c:1012 mlx5i_sq_xmit()
    error: NULL dereference inside function 'mlx5e_txwqe_build_eseg_csum()'

    drivers/net/ethernet/mellanox/mlx5/core/en_tx.c:143 mlx5e_txwqe_build_eseg_csum()
    warn: variable dereferenced before check 'accel' (see line 125)

drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
    978 void mlx5i_sq_xmit(struct mlx5e_txqsq *sq, struct sk_buff *skb,
    979                    struct mlx5_av *av, u32 dqpn, u32 dqkey, bool xmit_more)
    980 {
    981         struct mlx5e_tx_wqe_attr wqe_attr;
    982         struct mlx5e_tx_attr attr;
    983         struct mlx5i_tx_wqe *wqe;
    984 
    985         struct mlx5_wqe_datagram_seg *datagram;
    986         struct mlx5_wqe_ctrl_seg *cseg;
    987         struct mlx5_wqe_eth_seg  *eseg;
    988         struct mlx5_wqe_data_seg *dseg;
    989         struct mlx5e_tx_wqe_info *wi;
    990 
    991         struct mlx5e_sq_stats *stats = sq->stats;
    992         int num_dma;
    993         u16 pi;
    994 
    995         mlx5e_sq_xmit_prepare(sq, skb, NULL, &attr);
    996         mlx5i_sq_calc_wqe_attr(skb, &attr, &wqe_attr);
    997 
    998         pi = mlx5e_txqsq_get_next_pi(sq, wqe_attr.num_wqebbs);
    999         wqe = MLX5I_SQ_FETCH_WQE(sq, pi);
    1000 
    1001         stats->xmit_more += xmit_more;
    1002 
    1003         /* fill wqe */
    1004         wi       = &sq->db.wqe_info[pi];
    1005         cseg     = &wqe->ctrl;
    1006         datagram = &wqe->datagram;
    1007         eseg     = &wqe->eth;
    1008         dseg     =  wqe->data;
    1009 
    1010         mlx5i_txwqe_build_datagram(av, dqpn, dqkey, datagram);
    1011 
--> 1012         mlx5e_txwqe_build_eseg_csum(sq, skb, NULL, eseg);
                                                      ^^^^
The patch adds an unchecked dereference of this NULL pointer.  There are
other callers as well.

    1013 
    1014         eseg->mss = attr.mss;
    1015 
    1016         if (attr.ihs) {
    1017                 if (unlikely(attr.hopbyhop)) {

regards,
dan carpenter