[RFT 1/4] net/mlx5: fix NULL dereference in Tx queue start

Stephen Hemminger stephen at networkplumber.org
Tue Feb 17 16:04:59 CET 2026


mlx5_txq_get() can return NULL for an unconfigured queue index,
but the result is dereferenced to initialise txq_data before the
NULL check on the following line.  Move the txq_data assignment
after the NULL guard.

Fixes: 6f356d3840e6 ("net/mlx5: pass DevX object info in Tx queue start")
Cc: stable at dpdk.org

Signed-off-by: Stephen Hemminger <stephen at networkplumber.org>
---
 drivers/net/mlx5/mlx5_trigger.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/mlx5/mlx5_trigger.c b/drivers/net/mlx5/mlx5_trigger.c
index f155b1a7a0..a070aaecfd 100644
--- a/drivers/net/mlx5/mlx5_trigger.c
+++ b/drivers/net/mlx5/mlx5_trigger.c
@@ -59,10 +59,11 @@ mlx5_txq_start(struct rte_eth_dev *dev)
 	for (cnt = log_max_wqe; cnt > 0; cnt -= 1) {
 		for (i = 0; i != priv->txqs_n; ++i) {
 			struct mlx5_txq_ctrl *txq_ctrl = mlx5_txq_get(dev, i);
-			struct mlx5_txq_data *txq_data = &txq_ctrl->txq;
+			struct mlx5_txq_data *txq_data;
 
 			if (!txq_ctrl)
 				continue;
+			txq_data = &txq_ctrl->txq;
 			if (txq_data->elts_n != cnt) {
 				mlx5_txq_release(dev, i);
 				continue;
-- 
2.51.0



More information about the stable mailing list