Hi,
On 17/02/2026 5:04 PM, Stephen Hemminger wrote:
Found these during a code review of the mlx5 driver. I don't have
ConnectX hardware to test, so sending as RFC for maintainers to
verify and test.
Summary:
1/4 NULL pointer dereference in mlx5_txq_start() - txq_ctrl is
dereferenced before the NULL check one line later.
2/4 DevX queue counter leak in hairpin counter setup - the
counter object is not freed when the subsequent modify call
fails.
3/4 Use-after-free in ASO age and CT management init - on queue
init failure the management structure is freed but the
pointer is not NULLed, so a retry dereferences freed memory.
4/4 64-bit counter truncation - uint64_t* cast to uint32_t*
leaves the upper 32 bits uninitialised, producing wrong
hairpin queue statistics.
Stephen Hemminger (4):
net/mlx5: fix NULL dereference in Tx queue start
net/mlx5: fix counter leak in hairpin queue setup
net/mlx5: fix use-after-free in ASO management init
net/mlx5: fix counter truncation in queue counter read
drivers/net/mlx5/mlx5.c | 13 ++++++++++++-
drivers/net/mlx5/mlx5_trigger.c | 3 ++-
2 files changed, 14 insertions(+), 2 deletions(-)
Series applied to next-net-mlx,
Kindest regards
Raslan Darawsheh
