patch 'net/mlx5: fix external queues access' has been queued to stable release 24.11.4

[Kevin Traynor <ktraynor@redhat.com>]

Hi,

FYI, your patch has been queued to stable release 24.11.4

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 11/26/25. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/5e1e4e9ba29946a0bbd50aa02b050afb83bf0ef1

Thanks.

Kevin

---
From 5e1e4e9ba29946a0bbd50aa02b050afb83bf0ef1 Mon Sep 17 00:00:00 2001
From: Gregory Etelson <getelson@nvidia.com>
Date: Thu, 30 Oct 2025 11:11:38 +0200
Subject: [PATCH] net/mlx5: fix external queues access

[ upstream commit d524b58819b46ea47d02338204d24c2f2ba29ee2 ]

mlx5_ext_rxq_get() and mlx5_ext_txq_get() functions did not return
NULL value if query index was not referencing external queue.

As a result, calling functions did not expect the NULL on return.

External Rx queue:

- In mlx5_ext_rxq_get() remove assert and return NULL if a queue index
  does not point to a valid external queue.

- In mlx5_ext_rxq_verify() validate that probed queue index references
  a valid extern queue.

External Tx queue:

-  In mlx5_ext_txq_get() remove assert and return NULL if a queue index
   does not point to a valid external queue.

- In mlx5_ext_txq_verify() validate that probed queue index references
  a valid extern queue.

Fixes: 311b17e669ab ("net/mlx5: support queue/RSS actions for external Rx queue")

Signed-off-by: Gregory Etelson <getelson@nvidia.com>
Acked-by: Dariusz Sosnowski <dsosnowski@nvidia.com>
---
 drivers/net/mlx5/mlx5_devx.c |  5 +++++
 drivers/net/mlx5/mlx5_flow.h |  2 ++
 drivers/net/mlx5/mlx5_rxq.c  | 17 ++++++++++-------
 drivers/net/mlx5/mlx5_txq.c  | 10 +++++-----
 4 files changed, 22 insertions(+), 12 deletions(-)

diff --git a/drivers/net/mlx5/mlx5_devx.c b/drivers/net/mlx5/mlx5_devx.c
index 7ca95e81c6..5a71f2a21d 100644
--- a/drivers/net/mlx5/mlx5_devx.c
+++ b/drivers/net/mlx5/mlx5_devx.c
@@ -777,4 +777,9 @@ mlx5_devx_ind_table_create_rqt_attr(struct rte_eth_dev *dev,
 					mlx5_ext_rxq_get(dev, queues[i]);
 
+			if (ext_rxq == NULL) {
+				rte_errno = EINVAL;
+				mlx5_free(rqt_attr);
+				return NULL;
+			}
 			rqt_attr->rq_list[i] = ext_rxq->hw_id;
 		} else {
diff --git a/drivers/net/mlx5/mlx5_flow.h b/drivers/net/mlx5/mlx5_flow.h
index c8ab114655..cfdaaac812 100644
--- a/drivers/net/mlx5/mlx5_flow.h
+++ b/drivers/net/mlx5/mlx5_flow.h
@@ -2010,4 +2010,6 @@ flow_hw_get_sqn(struct rte_eth_dev *dev, uint16_t tx_queue, uint32_t *sqn)
 	if (mlx5_is_external_txq(dev, tx_queue)) {
 		ext_txq = mlx5_ext_txq_get(dev, tx_queue);
+		if (ext_txq == NULL)
+			return -EINVAL;
 		*sqn = ext_txq->hw_id;
 		return 0;
diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c
index 0f504e4dd3..76fddb262e 100644
--- a/drivers/net/mlx5/mlx5_rxq.c
+++ b/drivers/net/mlx5/mlx5_rxq.c
@@ -2162,5 +2162,6 @@ mlx5_ext_rxq_ref(struct rte_eth_dev *dev, uint16_t idx)
 	struct mlx5_external_q *rxq = mlx5_ext_rxq_get(dev, idx);
 
-	rte_atomic_fetch_add_explicit(&rxq->refcnt, 1, rte_memory_order_relaxed);
+	if (rxq != NULL)
+		rte_atomic_fetch_add_explicit(&rxq->refcnt, 1, rte_memory_order_relaxed);
 	return rxq;
 }
@@ -2182,5 +2183,7 @@ mlx5_ext_rxq_deref(struct rte_eth_dev *dev, uint16_t idx)
 	struct mlx5_external_q *rxq = mlx5_ext_rxq_get(dev, idx);
 
-	return rte_atomic_fetch_sub_explicit(&rxq->refcnt, 1, rte_memory_order_relaxed) - 1;
+	return rxq != NULL ?
+		rte_atomic_fetch_sub_explicit(&rxq->refcnt, 1, rte_memory_order_relaxed) - 1 :
+		UINT32_MAX;
 }
 
@@ -2201,6 +2204,6 @@ mlx5_ext_rxq_get(struct rte_eth_dev *dev, uint16_t idx)
 	struct mlx5_priv *priv = dev->data->dev_private;
 
-	MLX5_ASSERT(mlx5_is_external_rxq(dev, idx));
-	return &priv->ext_rxqs[idx - RTE_PMD_MLX5_EXTERNAL_RX_QUEUE_ID_MIN];
+	return mlx5_is_external_rxq(dev, idx) ?
+		&priv->ext_rxqs[idx -  RTE_PMD_MLX5_EXTERNAL_RX_QUEUE_ID_MIN] : NULL;
 }
 
@@ -2365,5 +2368,4 @@ mlx5_ext_rxq_verify(struct rte_eth_dev *dev)
 {
 	struct mlx5_priv *priv = dev->data->dev_private;
-	struct mlx5_external_q *rxq;
 	uint32_t i;
 	int ret = 0;
@@ -2373,6 +2375,7 @@ mlx5_ext_rxq_verify(struct rte_eth_dev *dev)
 
 	for (i = RTE_PMD_MLX5_EXTERNAL_RX_QUEUE_ID_MIN; i <= UINT16_MAX ; ++i) {
-		rxq = mlx5_ext_rxq_get(dev, i);
-		if (rxq->refcnt < 2)
+		struct mlx5_external_q *rxq = mlx5_ext_rxq_get(dev, i);
+
+		if (rxq == NULL || rxq->refcnt < 2)
 			continue;
 		DRV_LOG(DEBUG, "Port %u external RxQ %u still referenced.",
diff --git a/drivers/net/mlx5/mlx5_txq.c b/drivers/net/mlx5/mlx5_txq.c
index f74af5471e..67cbd8bd55 100644
--- a/drivers/net/mlx5/mlx5_txq.c
+++ b/drivers/net/mlx5/mlx5_txq.c
@@ -1210,6 +1210,6 @@ mlx5_ext_txq_get(struct rte_eth_dev *dev, uint16_t idx)
 	struct mlx5_priv *priv = dev->data->dev_private;
 
-	MLX5_ASSERT(mlx5_is_external_txq(dev, idx));
-	return &priv->ext_txqs[idx - MLX5_EXTERNAL_TX_QUEUE_ID_MIN];
+	return mlx5_is_external_txq(dev, idx) ?
+		&priv->ext_txqs[idx - MLX5_EXTERNAL_TX_QUEUE_ID_MIN] : NULL;
 }
 
@@ -1227,5 +1227,4 @@ mlx5_ext_txq_verify(struct rte_eth_dev *dev)
 {
 	struct mlx5_priv *priv = dev->data->dev_private;
-	struct mlx5_external_q *txq;
 	uint32_t i;
 	int ret = 0;
@@ -1235,6 +1234,7 @@ mlx5_ext_txq_verify(struct rte_eth_dev *dev)
 
 	for (i = MLX5_EXTERNAL_TX_QUEUE_ID_MIN; i <= UINT16_MAX ; ++i) {
-		txq = mlx5_ext_txq_get(dev, i);
-		if (txq->refcnt < 2)
+		struct mlx5_external_q *txq = mlx5_ext_txq_get(dev, i);
+
+		if (txq == NULL || txq->refcnt < 2)
 			continue;
 		DRV_LOG(DEBUG, "Port %u external TxQ %u still referenced.",
-- 
2.51.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2025-11-21 11:05:11.134009316 +0000
+++ 0049-net-mlx5-fix-external-queues-access.patch	2025-11-21 11:05:09.485201263 +0000
@@ -1 +1 @@
-From d524b58819b46ea47d02338204d24c2f2ba29ee2 Mon Sep 17 00:00:00 2001
+From 5e1e4e9ba29946a0bbd50aa02b050afb83bf0ef1 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit d524b58819b46ea47d02338204d24c2f2ba29ee2 ]
+
@@ -28 +29,0 @@
-Cc: stable@dpdk.org
@@ -40 +41 @@
-index 673c9f3902..523b53d713 100644
+index 7ca95e81c6..5a71f2a21d 100644
@@ -43 +44 @@
-@@ -762,4 +762,9 @@ mlx5_devx_ind_table_create_rqt_attr(struct rte_eth_dev *dev,
+@@ -777,4 +777,9 @@ mlx5_devx_ind_table_create_rqt_attr(struct rte_eth_dev *dev,
@@ -54 +55 @@
-index 2de0f35815..308aeadcc8 100644
+index c8ab114655..cfdaaac812 100644
@@ -57 +58 @@
-@@ -2043,4 +2043,6 @@ flow_hw_get_sqn(struct rte_eth_dev *dev, uint16_t tx_queue, uint32_t *sqn)
+@@ -2010,4 +2010,6 @@ flow_hw_get_sqn(struct rte_eth_dev *dev, uint16_t tx_queue, uint32_t *sqn)
@@ -65 +66 @@
-index 2264dea877..9210a92c5f 100644
+index 0f504e4dd3..76fddb262e 100644
@@ -68 +69 @@
-@@ -2217,5 +2217,6 @@ mlx5_ext_rxq_ref(struct rte_eth_dev *dev, uint16_t idx)
+@@ -2162,5 +2162,6 @@ mlx5_ext_rxq_ref(struct rte_eth_dev *dev, uint16_t idx)
@@ -76 +77 @@
-@@ -2237,5 +2238,7 @@ mlx5_ext_rxq_deref(struct rte_eth_dev *dev, uint16_t idx)
+@@ -2182,5 +2183,7 @@ mlx5_ext_rxq_deref(struct rte_eth_dev *dev, uint16_t idx)
@@ -85 +86 @@
-@@ -2256,6 +2259,6 @@ mlx5_ext_rxq_get(struct rte_eth_dev *dev, uint16_t idx)
+@@ -2201,6 +2204,6 @@ mlx5_ext_rxq_get(struct rte_eth_dev *dev, uint16_t idx)
@@ -94 +95 @@
-@@ -2420,5 +2423,4 @@ mlx5_ext_rxq_verify(struct rte_eth_dev *dev)
+@@ -2365,5 +2368,4 @@ mlx5_ext_rxq_verify(struct rte_eth_dev *dev)
@@ -100 +101 @@
-@@ -2428,6 +2430,7 @@ mlx5_ext_rxq_verify(struct rte_eth_dev *dev)
+@@ -2373,6 +2375,7 @@ mlx5_ext_rxq_verify(struct rte_eth_dev *dev)
@@ -111 +112 @@
-index e20165d74e..e273486809 100644
+index f74af5471e..67cbd8bd55 100644
@@ -114 +115 @@
-@@ -1282,6 +1282,6 @@ mlx5_ext_txq_get(struct rte_eth_dev *dev, uint16_t idx)
+@@ -1210,6 +1210,6 @@ mlx5_ext_txq_get(struct rte_eth_dev *dev, uint16_t idx)
@@ -123 +124 @@
-@@ -1299,5 +1299,4 @@ mlx5_ext_txq_verify(struct rte_eth_dev *dev)
+@@ -1227,5 +1227,4 @@ mlx5_ext_txq_verify(struct rte_eth_dev *dev)
@@ -129 +130 @@
-@@ -1307,6 +1306,7 @@ mlx5_ext_txq_verify(struct rte_eth_dev *dev)
+@@ -1235,6 +1234,7 @@ mlx5_ext_txq_verify(struct rte_eth_dev *dev)