[RFT 0/4] net/mlx5: fix several correctness bugs

[Raslan Darawsheh]

Hi,


On 17/02/2026 5:04 PM, Stephen Hemminger wrote:
> Found these during a code review of the mlx5 driver.  I don't have
> ConnectX hardware to test, so sending as RFC for maintainers to
> verify and test.
> 
> Summary:
> 
>    1/4  NULL pointer dereference in mlx5_txq_start() - txq_ctrl is
>         dereferenced before the NULL check one line later.
> 
>    2/4  DevX queue counter leak in hairpin counter setup - the
>         counter object is not freed when the subsequent modify call
>         fails.
> 
>    3/4  Use-after-free in ASO age and CT management init - on queue
>         init failure the management structure is freed but the
>         pointer is not NULLed, so a retry dereferences freed memory.
> 
>    4/4  64-bit counter truncation - uint64_t* cast to uint32_t*
>         leaves the upper 32 bits uninitialised, producing wrong
>         hairpin queue statistics.
> 
> Stephen Hemminger (4):
>    net/mlx5: fix NULL dereference in Tx queue start
>    net/mlx5: fix counter leak in hairpin queue setup
>    net/mlx5: fix use-after-free in ASO management init
>    net/mlx5: fix counter truncation in queue counter read
> 
>   drivers/net/mlx5/mlx5.c         | 13 ++++++++++++-
>   drivers/net/mlx5/mlx5_trigger.c |  3 ++-
>   2 files changed, 14 insertions(+), 2 deletions(-)
> 

Series applied to next-net-mlx,

Kindest regards
Raslan Darawsheh