Re: [PATCH net-next] net/mlx5e: Mask wqe_id when handling rx cqe

[Leon Hwang <leon.hwang@linux.dev>]

On 14/1/26 16:23, Tariq Toukan wrote:
> 
> 
> On 12/01/2026 10:03, Leon Hwang wrote:
>> The wqe_id from CQE contains wrap counter bits in addition to the WQE
>> index. Mask it with sz_m1 to prevent out-of-bounds access to the
>> rq->mpwqe.info[] array when wrap counter causes wqe_id to exceed RQ size.
>>
>> Without this fix, the driver crashes with NULL pointer dereference:
>>
>>    BUG: kernel NULL pointer dereference, address: 0000000000000020
>>    RIP: 0010:mlx5e_skb_from_cqe_mpwrq_linear+0xb3/0x280 [mlx5_core]
>>    Call Trace:
>>     <IRQ>
>>     mlx5e_handle_rx_cqe_mpwrq+0xe3/0x290 [mlx5_core]
>>     mlx5e_poll_rx_cq+0x97/0x820 [mlx5_core]
>>     mlx5e_napi_poll+0x110/0x820 [mlx5_core]
>>
> 
> Hi,
> 
> We do not expect out-of-bounds index, fixing it this way is not
> necessarily correct.
> 
> Can you please elaborate on your test case, setup, and how to repro?

Hi,

Thanks for the feedback.

Unfortunately, we cannot reliably reproduce this issue on demand, as it
was triggered on a production server. However, we preserved both the
dmesg output and the coredump.

From analysis of the coredump, the wqe_id value was *4167*, which is
unexpectedly out of bounds for the RQ size and led to the NULL pointer
dereference shown above.

For reference, here is the environment where the issue was observed:

NIC:      Mellanox Technologies MT2892 Family [ConnectX-6 Dx]
Firmware: 22.43.2566 (MT_0000000359)
OFED:     MLNX_OFED 24.10-2.1.8
Kernel:   5.15.0-189.012-shopee (Ubuntu 24.04 based)

Queue configuration:
# ethtool -g enp23s0f0np0
RX: 4096
TX: 4096
# ethtool -l enp23s0f0np0
Combined: 20

Please let me know if additional details would be helpful.

Thanks,
Leon

[...]