[PATCH 22.11 v2] net/mlx5: fix external queues access

[Shani Peretz]

> -----Original Message-----
> From: Gregory Etelson <getelson at nvidia.com>
> Sent: Tuesday, 18 November 2025 11:59
> To: stable at dpdk.org
> Cc: Gregory Etelson <getelson at nvidia.com>; Maayan Kashani
> <mkashani at nvidia.com>; Raslan Darawsheh <rasland at nvidia.com>; Dariusz
> Sosnowski <dsosnowski at nvidia.com>
> Subject: [PATCH 22.11 v2] net/mlx5: fix external queues access
> 
> External email: Use caution opening links or attachments
> 
> 
> [ upstream commit d524b58819b46ea47d02338204d24c2f2ba29ee2 ]
> 
> mlx5_ext_rxq_get() did not return
> NULL value if query index was not referencing external queue.
> 
> As a result, calling functions did not expect the NULL on return.
> 
> External Rx queue:
> 
> - In mlx5_ext_rxq_get() remove assert and return NULL if a queue index
>   does not point to a valid external queue.
> 
> - In mlx5_ext_rxq_verify() validate that probed queue index references
>   a valid extern queue.
> 
> Fixes: 311b17e669ab ("net/mlx5: support queue/RSS actions for external Rx
> queue")
> Cc: stable at dpdk.org
> 
> Signed-off-by: Gregory Etelson <getelson at nvidia.com>
> Acked-by: Dariusz Sosnowski <dsosnowski at nvidia.com>
> ---
>  drivers/net/mlx5/mlx5_devx.c |  5 +++++  drivers/net/mlx5/mlx5_rxq.c  | 17
> ++++++++++-------
>  2 files changed, 15 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/net/mlx5/mlx5_devx.c b/drivers/net/mlx5/mlx5_devx.c
> index abdf461a32..8cee16ead9 100644
> --- a/drivers/net/mlx5/mlx5_devx.c
> +++ b/drivers/net/mlx5/mlx5_devx.c
> @@ -681,6 +681,11 @@ mlx5_devx_ind_table_create_rqt_attr(struct
> rte_eth_dev *dev,
>                         struct mlx5_external_rxq *ext_rxq =
>                                         mlx5_ext_rxq_get(dev, queues[i]);
> 
> +                       if (ext_rxq == NULL) {
> +                               rte_errno = EINVAL;
> +                               mlx5_free(rqt_attr);
> +                               return NULL;
> +                       }
>                         rqt_attr->rq_list[i] = ext_rxq->hw_id;
>                 } else {
>                         struct mlx5_rxq_priv *rxq = diff --git
> a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c index
> b1834aac7c..24612e9125 100644
> --- a/drivers/net/mlx5/mlx5_rxq.c
> +++ b/drivers/net/mlx5/mlx5_rxq.c
> @@ -2152,7 +2152,8 @@ mlx5_ext_rxq_ref(struct rte_eth_dev *dev, uint16_t
> idx)  {
>         struct mlx5_external_rxq *rxq = mlx5_ext_rxq_get(dev, idx);
> 
> -       __atomic_fetch_add(&rxq->refcnt, 1, __ATOMIC_RELAXED);
> +       if (rxq != NULL)
> +               __atomic_fetch_add(&rxq->refcnt, 1, __ATOMIC_RELAXED);
>         return rxq;
>  }
> 
> @@ -2172,7 +2173,9 @@ mlx5_ext_rxq_deref(struct rte_eth_dev *dev,
> uint16_t idx)  {
>         struct mlx5_external_rxq *rxq = mlx5_ext_rxq_get(dev, idx);
> 
> -       return __atomic_sub_fetch(&rxq->refcnt, 1, __ATOMIC_RELAXED);
> +       return rxq != NULL ?
> +               __atomic_sub_fetch(&rxq->refcnt, 1, __ATOMIC_RELAXED) :
> +               UINT32_MAX;
>  }
> 
>  /**
> @@ -2191,8 +2194,8 @@ mlx5_ext_rxq_get(struct rte_eth_dev *dev, uint16_t
> idx)  {
>         struct mlx5_priv *priv = dev->data->dev_private;
> 
> -       MLX5_ASSERT(mlx5_is_external_rxq(dev, idx));
> -       return &priv->ext_rxqs[idx - MLX5_EXTERNAL_RX_QUEUE_ID_MIN];
> +       return mlx5_is_external_rxq(dev, idx) ?
> +               &priv->ext_rxqs[idx - MLX5_EXTERNAL_RX_QUEUE_ID_MIN] :
> + NULL;
>  }
> 
>  /**
> @@ -2352,7 +2355,6 @@ int
>  mlx5_ext_rxq_verify(struct rte_eth_dev *dev)  {
>         struct mlx5_priv *priv = dev->data->dev_private;
> -       struct mlx5_external_rxq *rxq;
>         uint32_t i;
>         int ret = 0;
> 
> @@ -2360,8 +2362,9 @@ mlx5_ext_rxq_verify(struct rte_eth_dev *dev)
>                 return 0;
> 
>         for (i = MLX5_EXTERNAL_RX_QUEUE_ID_MIN; i <= UINT16_MAX ; ++i) {
> -               rxq = mlx5_ext_rxq_get(dev, i);
> -               if (rxq->refcnt < 2)
> +               struct mlx5_external_rxq *rxq = mlx5_ext_rxq_get(dev,
> + i);
> +
> +               if (rxq == NULL || rxq->refcnt < 2)
>                         continue;
>                 DRV_LOG(DEBUG, "Port %u external RxQ %u still referenced.",
>                         dev->data->port_id, i);
> --
> 2.51.0

Hey,
This patch has also been applied to 23.11.
 
Thanks,
Shani