[PATCH 22.11 v2] net/mlx5: fix external queues access

[Gregory Etelson <getelson@nvidia.com>]

[ upstream commit d524b58819b46ea47d02338204d24c2f2ba29ee2 ]

mlx5_ext_rxq_get() did not return
NULL value if query index was not referencing external queue.

As a result, calling functions did not expect the NULL on return.

External Rx queue:

- In mlx5_ext_rxq_get() remove assert and return NULL if a queue index
  does not point to a valid external queue.

- In mlx5_ext_rxq_verify() validate that probed queue index references
  a valid extern queue.

Fixes: 311b17e669ab ("net/mlx5: support queue/RSS actions for external Rx queue")
Cc: stable@dpdk.org

Signed-off-by: Gregory Etelson <getelson@nvidia.com>
Acked-by: Dariusz Sosnowski <dsosnowski@nvidia.com>
---
 drivers/net/mlx5/mlx5_devx.c |  5 +++++
 drivers/net/mlx5/mlx5_rxq.c  | 17 ++++++++++-------
 2 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/drivers/net/mlx5/mlx5_devx.c b/drivers/net/mlx5/mlx5_devx.c
index abdf461a32..8cee16ead9 100644
--- a/drivers/net/mlx5/mlx5_devx.c
+++ b/drivers/net/mlx5/mlx5_devx.c
@@ -681,6 +681,11 @@ mlx5_devx_ind_table_create_rqt_attr(struct rte_eth_dev *dev,
 			struct mlx5_external_rxq *ext_rxq =
 					mlx5_ext_rxq_get(dev, queues[i]);
 
+			if (ext_rxq == NULL) {
+				rte_errno = EINVAL;
+				mlx5_free(rqt_attr);
+				return NULL;
+			}
 			rqt_attr->rq_list[i] = ext_rxq->hw_id;
 		} else {
 			struct mlx5_rxq_priv *rxq =
diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c
index b1834aac7c..24612e9125 100644
--- a/drivers/net/mlx5/mlx5_rxq.c
+++ b/drivers/net/mlx5/mlx5_rxq.c
@@ -2152,7 +2152,8 @@ mlx5_ext_rxq_ref(struct rte_eth_dev *dev, uint16_t idx)
 {
 	struct mlx5_external_rxq *rxq = mlx5_ext_rxq_get(dev, idx);
 
-	__atomic_fetch_add(&rxq->refcnt, 1, __ATOMIC_RELAXED);
+	if (rxq != NULL)
+		__atomic_fetch_add(&rxq->refcnt, 1, __ATOMIC_RELAXED);
 	return rxq;
 }
 
@@ -2172,7 +2173,9 @@ mlx5_ext_rxq_deref(struct rte_eth_dev *dev, uint16_t idx)
 {
 	struct mlx5_external_rxq *rxq = mlx5_ext_rxq_get(dev, idx);
 
-	return __atomic_sub_fetch(&rxq->refcnt, 1, __ATOMIC_RELAXED);
+	return rxq != NULL ?
+		__atomic_sub_fetch(&rxq->refcnt, 1, __ATOMIC_RELAXED) :
+		UINT32_MAX;
 }
 
 /**
@@ -2191,8 +2194,8 @@ mlx5_ext_rxq_get(struct rte_eth_dev *dev, uint16_t idx)
 {
 	struct mlx5_priv *priv = dev->data->dev_private;
 
-	MLX5_ASSERT(mlx5_is_external_rxq(dev, idx));
-	return &priv->ext_rxqs[idx - MLX5_EXTERNAL_RX_QUEUE_ID_MIN];
+	return mlx5_is_external_rxq(dev, idx) ?
+		&priv->ext_rxqs[idx - MLX5_EXTERNAL_RX_QUEUE_ID_MIN] : NULL;
 }
 
 /**
@@ -2352,7 +2355,6 @@ int
 mlx5_ext_rxq_verify(struct rte_eth_dev *dev)
 {
 	struct mlx5_priv *priv = dev->data->dev_private;
-	struct mlx5_external_rxq *rxq;
 	uint32_t i;
 	int ret = 0;
 
@@ -2360,8 +2362,9 @@ mlx5_ext_rxq_verify(struct rte_eth_dev *dev)
 		return 0;
 
 	for (i = MLX5_EXTERNAL_RX_QUEUE_ID_MIN; i <= UINT16_MAX ; ++i) {
-		rxq = mlx5_ext_rxq_get(dev, i);
-		if (rxq->refcnt < 2)
+		struct mlx5_external_rxq *rxq = mlx5_ext_rxq_get(dev, i);
+
+		if (rxq == NULL || rxq->refcnt < 2)
 			continue;
 		DRV_LOG(DEBUG, "Port %u external RxQ %u still referenced.",
 			dev->data->port_id, i);
-- 
2.51.0