RE: [PATCH v2] net/mlx5: fix uint16 underflow on Rx queue error path

Hi,

> -----Original Message-----
> From: Maayan Kashani <[email protected]>
> Sent: Sunday, August 9, 2026 5:49 PM
> To: [email protected]
> Cc: Maayan Kashani <[email protected]>; Raslan Darawsheh
> <[email protected]>; [email protected]; Dariusz Sosnowski
> <[email protected]>; Slava Ovsiienko <[email protected]>; Bing
> Zhao <[email protected]>; Ori Kam <[email protected]>; Suanming Mou
> <[email protected]>; Matan Azrad <[email protected]>; NBU-Contact-Thomas
> Monjalon (EXTERNAL) <[email protected]>; Gregory Etelson
> <[email protected]>
> Subject: [PATCH v2] net/mlx5: fix uint16 underflow on Rx queue error path
> 
> Avoid post-decrementing the segment index when it is zero in the error
> cleanup path of mlx5_rxq_mempool_register().
> 
> Coverity issue: 503770
> Fixes: 8d1cb02da5b7 ("net/mlx5: support selective Rx")
> Cc: [email protected]
> 
> Signed-off-by: Maayan Kashani <[email protected]>
> ---
>  drivers/net/mlx5/mlx5_trigger.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/net/mlx5/mlx5_trigger.c
> b/drivers/net/mlx5/mlx5_trigger.c index 25847c8ba2e..25bb448a708 100644
> --- a/drivers/net/mlx5/mlx5_trigger.c
> +++ b/drivers/net/mlx5/mlx5_trigger.c
> @@ -187,10 +187,13 @@ mlx5_rxq_mempool_register(struct mlx5_rxq_ctrl
> *rxq_ctrl)
>  	return 0;
> 
>  error:
> -	while (s-- > 0) {
> +	while (s > 0) {
> +		s--;
>  		seg = &rxq_ctrl->rxq.rxseg[s];
> -		mlx5_free(seg->null_mbuf);
> -		seg->null_mbuf = NULL;
> +		if (seg->mp == NULL) {
> +			mlx5_free(seg->null_mbuf);
> +			seg->null_mbuf = NULL;
> +		}
>  	}
>  	return ret;
>  }
> --
> 2.21.0

Acked-by: Bing Zhao <[email protected]>