patch 'net/gve: set mbuf to null in software ring after use' has been queued to stable release 24.11.7

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.7

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 07/15/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/0c58d6c78031a5d1e517d805417f31a728722707

Thanks.

Luca Boccassi

---
>From 0c58d6c78031a5d1e517d805417f31a728722707 Mon Sep 17 00:00:00 2001
From: Joshua Washington <joshwash at google.com>
Date: Wed, 8 Jul 2026 21:07:33 -0700
Subject: [PATCH] net/gve: set mbuf to null in software ring after use

[ upstream commit 3ca4cbcc74defdba608a6cafb058ca0a71ab4de0 ]

Currently, it is possible for mbufs to be uncleared in the sw_ring after
being returned to the application. This causes an erroneous
dual-ownership over the buffer until GVE cleans the buffer queue and
posts new mbufs, overwriting the older pointers. It is possible in such
a case for a double free to occur while tearing down rings, as both
the application and the driver could attempt to free the same mbuf.
Release ownership of the mbuf from the sw_ring as soon as appropriate to
avoid such a scenario.

Fixes: a46583cf43c8 ("net/gve: support Rx/Tx")
Fixes: 45da16b5b181 ("net/gve: support basic Rx data path for DQO")

Signed-off-by: Joshua Washington <joshwash at google.com>
Reviewed-by: Jasper Tran O'Leary <jtranoleary at google.com>
---
 drivers/net/gve/gve_rx.c     | 1 +
 drivers/net/gve/gve_rx_dqo.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/net/gve/gve_rx.c b/drivers/net/gve/gve_rx.c
index 7a91c31ad2..a151a9dfe2 100644
--- a/drivers/net/gve/gve_rx.c
+++ b/drivers/net/gve/gve_rx.c
@@ -152,6 +152,7 @@ gve_rx(struct gve_rx_queue *rxq, volatile struct gve_rx_desc *rxd, uint16_t rx_i
 
 	rxe = rxq->sw_ring[rx_id];
 	gve_rx_mbuf(rxq, rxe, frag_size, rx_id);
+	rxq->sw_ring[rx_id] = NULL;
 	rxq->stats.bytes += frag_size;
 
 	if (is_first_frag) {
diff --git a/drivers/net/gve/gve_rx_dqo.c b/drivers/net/gve/gve_rx_dqo.c
index cd85d90bb6..6faea848e3 100644
--- a/drivers/net/gve/gve_rx_dqo.c
+++ b/drivers/net/gve/gve_rx_dqo.c
@@ -152,6 +152,7 @@ gve_rx_burst_dqo(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t nb_pkts)
 		if (rx_id_bufq == rxq->nb_rx_desc)
 			rx_id_bufq = 0;
 		rxq->nb_rx_hold++;
+		rxq->sw_ring[rx_id_bufq] = NULL;
 
 		rxm->pkt_len = pkt_len;
 		rxm->data_len = pkt_len;
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-13 18:17:05.927011831 +0100
+++ 0009-net-gve-set-mbuf-to-null-in-software-ring-after-use.patch	2026-07-13 18:17:05.578282907 +0100
@@ -1 +1 @@
-From 3ca4cbcc74defdba608a6cafb058ca0a71ab4de0 Mon Sep 17 00:00:00 2001
+From 0c58d6c78031a5d1e517d805417f31a728722707 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 3ca4cbcc74defdba608a6cafb058ca0a71ab4de0 ]
+
@@ -17 +18,0 @@
-Cc: stable at dpdk.org
@@ -27 +28 @@
-index 625649cdcf..cda87af294 100644
+index 7a91c31ad2..a151a9dfe2 100644
@@ -39 +40 @@
-index c4e2d32067..3665d9e4cd 100644
+index cd85d90bb6..6faea848e3 100644
@@ -42,5 +43,5 @@
-@@ -207,6 +207,7 @@ gve_rx_burst_dqo(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t nb_pkts)
- 
- 		rxm = rxq->sw_ring[rx_buf_id];
- 		gve_completed_buf_list_push(rxq, rx_buf_id);
-+		rxq->sw_ring[rx_buf_id] = NULL;
+@@ -152,6 +152,7 @@ gve_rx_burst_dqo(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t nb_pkts)
+ 		if (rx_id_bufq == rxq->nb_rx_desc)
+ 			rx_id_bufq = 0;
+ 		rxq->nb_rx_hold++;
++		rxq->sw_ring[rx_id_bufq] = NULL;
@@ -48,2 +49,2 @@
- 		/* Free buffer and report error. */
- 		if (unlikely(rx_desc->rx_error)) {
+ 		rxm->pkt_len = pkt_len;
+ 		rxm->data_len = pkt_len;