[PATCH] net/mlx5: fix uint16 underflow on Rx queue error path

Maayan Kashani mkashani at nvidia.com
Thu Jul 30 15:56:19 CEST 2026


Avoid post-decrementing the segment index when it is zero in the
error cleanup path of mlx5_rxq_mempool_register().

Coverity issue: 503770
Fixes: 8d1cb02da5b7 ("net/mlx5: support selective Rx")
Cc: stable at dpdk.org

Signed-off-by: Maayan Kashani <mkashani at nvidia.com>
---
 drivers/net/mlx5/mlx5_trigger.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/net/mlx5/mlx5_trigger.c b/drivers/net/mlx5/mlx5_trigger.c
index c2804c58974..b6ce0133c93 100644
--- a/drivers/net/mlx5/mlx5_trigger.c
+++ b/drivers/net/mlx5/mlx5_trigger.c
@@ -187,10 +187,13 @@ mlx5_rxq_mempool_register(struct mlx5_rxq_ctrl *rxq_ctrl)
 	return 0;
 
 error:
-	while (s-- > 0) {
+	while (s > 0) {
+		s--;
 		seg = &rxq_ctrl->rxq.rxseg[s];
-		mlx5_free(seg->null_mbuf);
-		seg->null_mbuf = NULL;
+		if (!seg->mp) {
+			mlx5_free(seg->null_mbuf);
+			seg->null_mbuf = NULL;
+		}
 	}
 	return ret;
 }
-- 
2.21.0



More information about the stable mailing list