net/mlx5: fix external Rx and Tx queues access

PATCH Superseded Gregory Etelson 3 participants 6 messages Jul 31, 2025 – Nov 6, 2025 Network drivers

Share & tools

Gregory Etelson

author

2025-07-31 06:09 UTC #0 lore raw

PATCH 1/1 net/mlx5: fix external Rx and Tx queues access

mlx5_ext_rxq_get() and mlx5_ext_txq_get() functions did not return NULL value if query index was not referencing external queue.

As a result, calling functions did not expect the NULL on return.

External Rx queue:

- In mlx5_ext_rxq_get() remove assert and return NULL if a queue index does not point to a valid external queue.

- In mlx5_ext_rxq_verify() validate that probed queue index references a valid extern queue.

External Tx queue:

- In mlx5_ext_txq_get() remove assert and return NULL if a queue index does not point to a valid external queue.

- In mlx5_ext_txq_verify() validate that probed queue index references a valid extern queue.

Fixes 311b17e669ab ("net/mlx5: support queue/RSS actions for external Rx queue")

Signed-off-by Gregory Etelson <[email protected]>

Acked-by Dariusz Sosnowski <[email protected]>

---
 drivers/net/mlx5/mlx5_rxq.c | 10 +++++-----
 drivers/net/mlx5/mlx5_txq.c | 10 +++++-----
 2 files changed, 10 insertions(+), 10 deletions(-)

drivers/net/mlx5/mlx5_rxq.c +5 -5

index 77c5848c37..c615a5c64b 100644
@@ -2250,8 +2250,8 @@ mlx5_ext_rxq_get(struct rte_eth_dev *dev, uint16_t idx)
 {
 	struct mlx5_priv *priv = dev->data->dev_private;
 
-	MLX5_ASSERT(mlx5_is_external_rxq(dev, idx));
-	return &priv->ext_rxqs[idx - RTE_PMD_MLX5_EXTERNAL_RX_QUEUE_ID_MIN];
+	return mlx5_is_external_rxq(dev, idx) ?
+		&priv->ext_rxqs[idx -  RTE_PMD_MLX5_EXTERNAL_RX_QUEUE_ID_MIN] : NULL;
 }
 
 /**

@@ -2413,7 +2413,6 @@ int
 mlx5_ext_rxq_verify(struct rte_eth_dev *dev)
 {
 	struct mlx5_priv *priv = dev->data->dev_private;
-	struct mlx5_external_q *rxq;
 	uint32_t i;
 	int ret = 0;

@@ -2421,8 +2420,9 @@ mlx5_ext_rxq_verify(struct rte_eth_dev *dev)
 		return 0;
 
 	for (i = RTE_PMD_MLX5_EXTERNAL_RX_QUEUE_ID_MIN; i <= UINT16_MAX ; ++i) {
-		rxq = mlx5_ext_rxq_get(dev, i);
-		if (rxq->refcnt < 2)
+		struct mlx5_external_q *rxq = mlx5_ext_rxq_get(dev, i);
+
+		if (rxq == NULL || rxq->refcnt < 2)
 			continue;
 		DRV_LOG(DEBUG, "Port %u external RxQ %u still referenced.",
 			dev->data->port_id, i);

drivers/net/mlx5/mlx5_txq.c +5 -5

index b090d8274d..2aa2475a8a 100644
@@ -1281,8 +1281,8 @@ mlx5_ext_txq_get(struct rte_eth_dev *dev, uint16_t idx)
 {
 	struct mlx5_priv *priv = dev->data->dev_private;
 
-	MLX5_ASSERT(mlx5_is_external_txq(dev, idx));
-	return &priv->ext_txqs[idx - MLX5_EXTERNAL_TX_QUEUE_ID_MIN];
+	return mlx5_is_external_txq(dev, idx) ?
+		&priv->ext_txqs[idx - MLX5_EXTERNAL_TX_QUEUE_ID_MIN] : NULL;
 }
 
 /**

@@ -1298,7 +1298,6 @@ int
 mlx5_ext_txq_verify(struct rte_eth_dev *dev)
 {
 	struct mlx5_priv *priv = dev->data->dev_private;
-	struct mlx5_external_q *txq;
 	uint32_t i;
 	int ret = 0;

@@ -1306,8 +1305,9 @@ mlx5_ext_txq_verify(struct rte_eth_dev *dev)
 		return 0;
 
 	for (i = MLX5_EXTERNAL_TX_QUEUE_ID_MIN; i <= UINT16_MAX ; ++i) {
-		txq = mlx5_ext_txq_get(dev, i);
-		if (txq->refcnt < 2)
+		struct mlx5_external_q *txq = mlx5_ext_txq_get(dev, i);
+
+		if (txq == NULL || txq->refcnt < 2)
 			continue;
 		DRV_LOG(DEBUG, "Port %u external TxQ %u still referenced.",
 			dev->data->port_id, i);

Signature · 1 line

2.48.1

Raslan Darawsheh

2025-08-18 06:32 UTC #1 lore raw

Hi,

Quoted 18 lines · Gregory Etelson

mlx5_ext_rxq_get() and mlx5_ext_txq_get() functions did not return NULL value if query index was not referencing external queue.
As a result, calling functions did not expect the NULL on return.
External Rx queue:
- In mlx5_ext_rxq_get() remove assert and return NULL if a queue index does not point to a valid external queue.
- In mlx5_ext_rxq_verify() validate that probed queue index references a valid extern queue.
External Tx queue:
- In mlx5_ext_txq_get() remove assert and return NULL if a queue index does not point to a valid external queue.

Quoted 7 lines

- In mlx5_ext_txq_verify() validate that probed queue index references a valid extern queue.
Fixes 311b17e669ab ("net/mlx5: support queue/RSS actions for external Rx queue")
Signed-off-by Gregory Etelson <[email protected]>
Acked-by Dariusz Sosnowski <[email protected]>

Patch applied to next-net-mlx,

Kindest regards
Raslan Darawsheh

Thomas Monjalon

2025-09-08 21:29 UTC #2 lore raw

18/08/2025 08:32, Raslan Darawsheh:

Quoted 5 lines · Gregory Etelson

Quoted 4 lines
mlx5_ext_rxq_get() and mlx5_ext_txq_get() functions did not return NULL value if query index was not referencing external queue.
As a result, calling functions did not expect the NULL on return.

It is not clear what is the problem.

Quoted 16 lines

Quoted 16 lines
External Rx queue:
- In mlx5_ext_rxq_get() remove assert and return NULL if a queue index does not point to a valid external queue.
- In mlx5_ext_rxq_verify() validate that probed queue index references a valid extern queue.
External Tx queue:
- In mlx5_ext_txq_get() remove assert and return NULL if a queue index does not point to a valid external queue.
- In mlx5_ext_txq_verify() validate that probed queue index references a valid extern queue.

Quoted 6 lines

Quoted 4 lines
Fixes 311b17e669ab ("net/mlx5: support queue/RSS actions for external Rx queue")
Signed-off-by Gregory Etelson <[email protected]>
Acked-by Dariusz Sosnowski <[email protected]>
Patch applied to next-net-mlx,

The patch is returning NULL but it is not handled in calling functions. Thus MinGW compiler detects a problem:

In function 'mlx5_ext_rxq_ref',

    inlined from 'mlx5_rxqs_ref' at ../../dpdk/drivers/net/mlx5/mlx5_rxq.c:2303:8:
../../dpdk/lib/eal/include/rte_stdatomic.h:155:9: error: '__atomic_fetch_add_4' writing 4 bytes into a region of size 0 overflows the destination [-Werror=stringop-overflow=]
  155 |         __atomic_fetch_add(ptr, val, memorder)
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../../dpdk/drivers/net/mlx5/mlx5_rxq.c:2215:9: note: in expansion of macro 'rte_atomic_fetch_add_explicit'
 2215 |         rte_atomic_fetch_add_explicit(&rxq->refcnt, 1, rte_memory_order_relaxed);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~

In function 'mlx5_rxqs_ref':
cc1: note: destination object is likely at address zero

I dropped this patch while pulling next-net-mlx into main.

Please provide a new version of the patch addressing these issues. Thanks

Gregory Etelson

author

2025-10-30 07:42 UTC #3 lore raw

PATCH v2 1/1 net/mlx5: fix external Rx and Tx queues access

In reply to Gregory Etelson

mlx5_ext_rxq_get() and mlx5_ext_txq_get() functions did not return NULL value if query index was not referencing external queue.

As a result, calling functions did not expect the NULL on return.

External Rx queue:

- In mlx5_ext_rxq_get() remove assert and return NULL if a queue index does not point to a valid external queue.

- In mlx5_ext_rxq_verify() validate that probed queue index references a valid extern queue.

External Tx queue:

- In mlx5_ext_txq_get() remove assert and return NULL if a queue index does not point to a valid external queue.

- In mlx5_ext_txq_verify() validate that probed queue index references a valid extern queue.

Fixes 311b17e669ab ("net/mlx5: support queue/RSS actions for external Rx queue")

Signed-off-by Gregory Etelson <[email protected]>

Acked-by Dariusz Sosnowski <[email protected]>

---
v2: fixed MinGW compiler warnings

---
 drivers/net/mlx5/mlx5_devx.c |  5 +++++
 drivers/net/mlx5/mlx5_flow.h |  2 ++
 drivers/net/mlx5/mlx5_rxq.c  | 17 ++++++++++-------
 drivers/net/mlx5/mlx5_txq.c  | 10 +++++-----
 4 files changed, 22 insertions(+), 12 deletions(-)

drivers/net/mlx5/mlx5_devx.c +5 -0

index 673c9f3902..523b53d713 100644
@@ -761,6 +761,11 @@ mlx5_devx_ind_table_create_rqt_attr(struct rte_eth_dev *dev,
 			struct mlx5_external_q *ext_rxq =
 					mlx5_ext_rxq_get(dev, queues[i]);
 
+			if (ext_rxq == NULL) {
+				rte_errno = EINVAL;
+				mlx5_free(rqt_attr);
+				return NULL;
+			}
 			rqt_attr->rq_list[i] = ext_rxq->hw_id;
 		} else {
 			struct mlx5_rxq_priv *rxq =

drivers/net/mlx5/mlx5_flow.h +2 -0

index ff61706054..6ced0fd741 100644
@@ -2039,6 +2039,8 @@ flow_hw_get_sqn(struct rte_eth_dev *dev, uint16_t tx_queue, uint32_t *sqn)
 	}
 	if (mlx5_is_external_txq(dev, tx_queue)) {
 		ext_txq = mlx5_ext_txq_get(dev, tx_queue);
+		if (ext_txq == NULL)
+			return EINVAL;
 		*sqn = ext_txq->hw_id;
 		return 0;
 	}

drivers/net/mlx5/mlx5_rxq.c +10 -7

index 1425886a22..677e8491d3 100644
@@ -2212,7 +2212,8 @@ mlx5_ext_rxq_ref(struct rte_eth_dev *dev, uint16_t idx)
 {
 	struct mlx5_external_q *rxq = mlx5_ext_rxq_get(dev, idx);
 
-	rte_atomic_fetch_add_explicit(&rxq->refcnt, 1, rte_memory_order_relaxed);
+	if (rxq != NULL)
+		rte_atomic_fetch_add_explicit(&rxq->refcnt, 1, rte_memory_order_relaxed);
 	return rxq;
 }

@@ -2232,7 +2233,9 @@ mlx5_ext_rxq_deref(struct rte_eth_dev *dev, uint16_t idx)
 {
 	struct mlx5_external_q *rxq = mlx5_ext_rxq_get(dev, idx);
 
-	return rte_atomic_fetch_sub_explicit(&rxq->refcnt, 1, rte_memory_order_relaxed) - 1;
+	return rxq != NULL ?
+		rte_atomic_fetch_sub_explicit(&rxq->refcnt, 1, rte_memory_order_relaxed) - 1 :
+		UINT32_MAX;
 }
 
 /**

@@ -2251,8 +2254,8 @@ mlx5_ext_rxq_get(struct rte_eth_dev *dev, uint16_t idx)
 {
 	struct mlx5_priv *priv = dev->data->dev_private;
 
-	MLX5_ASSERT(mlx5_is_external_rxq(dev, idx));
-	return &priv->ext_rxqs[idx - RTE_PMD_MLX5_EXTERNAL_RX_QUEUE_ID_MIN];
+	return mlx5_is_external_rxq(dev, idx) ?
+		&priv->ext_rxqs[idx -  RTE_PMD_MLX5_EXTERNAL_RX_QUEUE_ID_MIN] : NULL;
 }
 
 /**

@@ -2415,7 +2418,6 @@ int
 mlx5_ext_rxq_verify(struct rte_eth_dev *dev)
 {
 	struct mlx5_priv *priv = dev->data->dev_private;
-	struct mlx5_external_q *rxq;
 	uint32_t i;
 	int ret = 0;

@@ -2423,8 +2425,9 @@ mlx5_ext_rxq_verify(struct rte_eth_dev *dev)
 		return 0;
 
 	for (i = RTE_PMD_MLX5_EXTERNAL_RX_QUEUE_ID_MIN; i <= UINT16_MAX ; ++i) {
-		rxq = mlx5_ext_rxq_get(dev, i);
-		if (rxq->refcnt < 2)
+		struct mlx5_external_q *rxq = mlx5_ext_rxq_get(dev, i);
+
+		if (rxq == NULL || rxq->refcnt < 2)
 			continue;
 		DRV_LOG(DEBUG, "Port %u external RxQ %u still referenced.",
 			dev->data->port_id, i);

drivers/net/mlx5/mlx5_txq.c +5 -5

index b090d8274d..2aa2475a8a 100644
@@ -1281,8 +1281,8 @@ mlx5_ext_txq_get(struct rte_eth_dev *dev, uint16_t idx)
 {
 	struct mlx5_priv *priv = dev->data->dev_private;
 
-	MLX5_ASSERT(mlx5_is_external_txq(dev, idx));
-	return &priv->ext_txqs[idx - MLX5_EXTERNAL_TX_QUEUE_ID_MIN];
+	return mlx5_is_external_txq(dev, idx) ?
+		&priv->ext_txqs[idx - MLX5_EXTERNAL_TX_QUEUE_ID_MIN] : NULL;
 }
 
 /**

@@ -1298,7 +1298,6 @@ int
 mlx5_ext_txq_verify(struct rte_eth_dev *dev)
 {
 	struct mlx5_priv *priv = dev->data->dev_private;
-	struct mlx5_external_q *txq;
 	uint32_t i;
 	int ret = 0;

@@ -1306,8 +1305,9 @@ mlx5_ext_txq_verify(struct rte_eth_dev *dev)
 		return 0;
 
 	for (i = MLX5_EXTERNAL_TX_QUEUE_ID_MIN; i <= UINT16_MAX ; ++i) {
-		txq = mlx5_ext_txq_get(dev, i);
-		if (txq->refcnt < 2)
+		struct mlx5_external_q *txq = mlx5_ext_txq_get(dev, i);
+
+		if (txq == NULL || txq->refcnt < 2)
 			continue;
 		DRV_LOG(DEBUG, "Port %u external TxQ %u still referenced.",
 			dev->data->port_id, i);

Signature · 1 line

2.51.0

Gregory Etelson

author

2025-10-30 09:13 UTC #4 lore raw

PATCH v3 1/1 net/mlx5: fix external Rx and Tx queues access

In reply to Gregory Etelson

mlx5_ext_rxq_get() and mlx5_ext_txq_get() functions did not return NULL value if query index was not referencing external queue.

As a result, calling functions did not expect the NULL on return.

External Rx queue:

- In mlx5_ext_rxq_get() remove assert and return NULL if a queue index does not point to a valid external queue.

- In mlx5_ext_rxq_verify() validate that probed queue index references a valid extern queue.

External Tx queue:

- In mlx5_ext_txq_get() remove assert and return NULL if a queue index does not point to a valid external queue.

- In mlx5_ext_txq_verify() validate that probed queue index references a valid extern queue.

Fixes 311b17e669ab ("net/mlx5: support queue/RSS actions for external Rx queue")

Signed-off-by Gregory Etelson <[email protected]>

Acked-by Dariusz Sosnowski <[email protected]>

---
v2: fixed MinGW compiler warnings.
v3: fix return value.

---
 drivers/net/mlx5/mlx5_devx.c |  5 +++++
 drivers/net/mlx5/mlx5_flow.h |  2 ++
 drivers/net/mlx5/mlx5_rxq.c  | 17 ++++++++++-------
 drivers/net/mlx5/mlx5_txq.c  | 10 +++++-----
 4 files changed, 22 insertions(+), 12 deletions(-)

drivers/net/mlx5/mlx5_devx.c +5 -0

index 673c9f3902..523b53d713 100644
@@ -761,6 +761,11 @@ mlx5_devx_ind_table_create_rqt_attr(struct rte_eth_dev *dev,
 			struct mlx5_external_q *ext_rxq =
 					mlx5_ext_rxq_get(dev, queues[i]);
 
+			if (ext_rxq == NULL) {
+				rte_errno = EINVAL;
+				mlx5_free(rqt_attr);
+				return NULL;
+			}
 			rqt_attr->rq_list[i] = ext_rxq->hw_id;
 		} else {
 			struct mlx5_rxq_priv *rxq =

drivers/net/mlx5/mlx5_flow.h +2 -0

index ff61706054..5b2e17a2a9 100644
@@ -2039,6 +2039,8 @@ flow_hw_get_sqn(struct rte_eth_dev *dev, uint16_t tx_queue, uint32_t *sqn)
 	}
 	if (mlx5_is_external_txq(dev, tx_queue)) {
 		ext_txq = mlx5_ext_txq_get(dev, tx_queue);
+		if (ext_txq == NULL)
+			return -EINVAL;
 		*sqn = ext_txq->hw_id;
 		return 0;
 	}

drivers/net/mlx5/mlx5_rxq.c +10 -7

index 1425886a22..677e8491d3 100644
@@ -2212,7 +2212,8 @@ mlx5_ext_rxq_ref(struct rte_eth_dev *dev, uint16_t idx)
 {
 	struct mlx5_external_q *rxq = mlx5_ext_rxq_get(dev, idx);
 
-	rte_atomic_fetch_add_explicit(&rxq->refcnt, 1, rte_memory_order_relaxed);
+	if (rxq != NULL)
+		rte_atomic_fetch_add_explicit(&rxq->refcnt, 1, rte_memory_order_relaxed);
 	return rxq;
 }

@@ -2232,7 +2233,9 @@ mlx5_ext_rxq_deref(struct rte_eth_dev *dev, uint16_t idx)
 {
 	struct mlx5_external_q *rxq = mlx5_ext_rxq_get(dev, idx);
 
-	return rte_atomic_fetch_sub_explicit(&rxq->refcnt, 1, rte_memory_order_relaxed) - 1;
+	return rxq != NULL ?
+		rte_atomic_fetch_sub_explicit(&rxq->refcnt, 1, rte_memory_order_relaxed) - 1 :
+		UINT32_MAX;
 }
 
 /**

@@ -2251,8 +2254,8 @@ mlx5_ext_rxq_get(struct rte_eth_dev *dev, uint16_t idx)
 {
 	struct mlx5_priv *priv = dev->data->dev_private;
 
-	MLX5_ASSERT(mlx5_is_external_rxq(dev, idx));
-	return &priv->ext_rxqs[idx - RTE_PMD_MLX5_EXTERNAL_RX_QUEUE_ID_MIN];
+	return mlx5_is_external_rxq(dev, idx) ?
+		&priv->ext_rxqs[idx -  RTE_PMD_MLX5_EXTERNAL_RX_QUEUE_ID_MIN] : NULL;
 }
 
 /**

@@ -2415,7 +2418,6 @@ int
 mlx5_ext_rxq_verify(struct rte_eth_dev *dev)
 {
 	struct mlx5_priv *priv = dev->data->dev_private;
-	struct mlx5_external_q *rxq;
 	uint32_t i;
 	int ret = 0;

@@ -2423,8 +2425,9 @@ mlx5_ext_rxq_verify(struct rte_eth_dev *dev)
 		return 0;
 
 	for (i = RTE_PMD_MLX5_EXTERNAL_RX_QUEUE_ID_MIN; i <= UINT16_MAX ; ++i) {
-		rxq = mlx5_ext_rxq_get(dev, i);
-		if (rxq->refcnt < 2)
+		struct mlx5_external_q *rxq = mlx5_ext_rxq_get(dev, i);
+
+		if (rxq == NULL || rxq->refcnt < 2)
 			continue;
 		DRV_LOG(DEBUG, "Port %u external RxQ %u still referenced.",
 			dev->data->port_id, i);

drivers/net/mlx5/mlx5_txq.c +5 -5

index b090d8274d..2aa2475a8a 100644
@@ -1281,8 +1281,8 @@ mlx5_ext_txq_get(struct rte_eth_dev *dev, uint16_t idx)
 {
 	struct mlx5_priv *priv = dev->data->dev_private;
 
-	MLX5_ASSERT(mlx5_is_external_txq(dev, idx));
-	return &priv->ext_txqs[idx - MLX5_EXTERNAL_TX_QUEUE_ID_MIN];
+	return mlx5_is_external_txq(dev, idx) ?
+		&priv->ext_txqs[idx - MLX5_EXTERNAL_TX_QUEUE_ID_MIN] : NULL;
 }
 
 /**

@@ -1298,7 +1298,6 @@ int
 mlx5_ext_txq_verify(struct rte_eth_dev *dev)
 {
 	struct mlx5_priv *priv = dev->data->dev_private;
-	struct mlx5_external_q *txq;
 	uint32_t i;
 	int ret = 0;

@@ -1306,8 +1305,9 @@ mlx5_ext_txq_verify(struct rte_eth_dev *dev)
 		return 0;
 
 	for (i = MLX5_EXTERNAL_TX_QUEUE_ID_MIN; i <= UINT16_MAX ; ++i) {
-		txq = mlx5_ext_txq_get(dev, i);
-		if (txq->refcnt < 2)
+		struct mlx5_external_q *txq = mlx5_ext_txq_get(dev, i);
+
+		if (txq == NULL || txq->refcnt < 2)
 			continue;
 		DRV_LOG(DEBUG, "Port %u external TxQ %u still referenced.",
 			dev->data->port_id, i);

Signature · 1 line

2.51.0

Raslan Darawsheh

2025-11-06 07:21 UTC #5 lore raw

Hi,

Quoted 21 lines · Gregory Etelson

mlx5_ext_rxq_get() and mlx5_ext_txq_get() functions did not return NULL value if query index was not referencing external queue.
As a result, calling functions did not expect the NULL on return.
External Rx queue:
- In mlx5_ext_rxq_get() remove assert and return NULL if a queue index does not point to a valid external queue.
- In mlx5_ext_rxq_verify() validate that probed queue index references a valid extern queue.
External Tx queue:
- In mlx5_ext_txq_get() remove assert and return NULL if a queue index does not point to a valid external queue.
- In mlx5_ext_txq_verify() validate that probed queue index references a valid extern queue.

Quoted 7 lines

Fixes 311b17e669ab ("net/mlx5: support queue/RSS actions for external Rx queue")
Signed-off-by Gregory Etelson <[email protected]>
Acked-by Dariusz Sosnowski <[email protected]>
---
v2: fixed MinGW compiler warnings.
v3: fix return value.

Patch applied to next-net-mlx,

Kindest regards
Raslan Darawsheh