patch 'net/ixgbe: fix shared PF pointer in representor' has been queued to stable release 25.11.3

[Kevin Traynor]

Hi,

FYI, your patch has been queued to stable release 25.11.3

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 07/27/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/25c947267d6fb6be7c0f7a4eeb76e8f5a535d710

Thanks.

Kevin

---
>From 25c947267d6fb6be7c0f7a4eeb76e8f5a535d710 Mon Sep 17 00:00:00 2001
From: Anatoly Burakov <anatoly.burakov at intel.com>
Date: Thu, 30 Apr 2026 12:14:31 +0100
Subject: [PATCH] net/ixgbe: fix shared PF pointer in representor

[ upstream commit 31cb98b1f275cf78d9e8d7fb46ee4f38b59186fc ]

Currently, ixgbe representor private data stores a PF ethdev pointer.
That pointer is process local, but it is stored in shared memory, so a
secondary process can read an invalid pointer value.

Fix this by storing PF port id in representor private data and resolving
PF ethdev from rte_eth_devices[] in each process. Return -ENODEV when the
PF port is not valid.

This is not technically a bug in practice as using `rte_flow` from
secondary processes isn't supported, but we still shouldn't do that.

Fixes: cf80ba6e2038 ("net/ixgbe: add support for representor ports")

Signed-off-by: Anatoly Burakov <anatoly.burakov at intel.com>
Acked-by: Bruce Richardson <bruce.richardson at intel.com>
---
 drivers/net/intel/ixgbe/ixgbe_ethdev.c        |  2 +-
 drivers/net/intel/ixgbe/ixgbe_ethdev.h        |  2 +-
 .../net/intel/ixgbe/ixgbe_vf_representor.c    | 63 ++++++++++++++-----
 3 files changed, 50 insertions(+), 17 deletions(-)

diff --git a/drivers/net/intel/ixgbe/ixgbe_ethdev.c b/drivers/net/intel/ixgbe/ixgbe_ethdev.c
index 990257dc05..7bfb8f1fed 100644
--- a/drivers/net/intel/ixgbe/ixgbe_ethdev.c
+++ b/drivers/net/intel/ixgbe/ixgbe_ethdev.c
@@ -1825,5 +1825,5 @@ eth_ixgbe_pci_probe(struct rte_pci_driver *pci_drv __rte_unused,
 		representor.vf_id = eth_da.representor_ports[i];
 		representor.switch_domain_id = vfinfo->switch_domain_id;
-		representor.pf_ethdev = pf_ethdev;
+		representor.pf_port_id = pf_ethdev->data->port_id;
 
 		/* representor port net_bdf_port */
diff --git a/drivers/net/intel/ixgbe/ixgbe_ethdev.h b/drivers/net/intel/ixgbe/ixgbe_ethdev.h
index 2e1b94a483..28ba1680c3 100644
--- a/drivers/net/intel/ixgbe/ixgbe_ethdev.h
+++ b/drivers/net/intel/ixgbe/ixgbe_ethdev.h
@@ -535,5 +535,5 @@ struct ixgbe_vf_representor {
 	uint16_t vf_id;
 	uint16_t switch_domain_id;
-	struct rte_eth_dev *pf_ethdev;
+	uint16_t pf_port_id;
 };
 
diff --git a/drivers/net/intel/ixgbe/ixgbe_vf_representor.c b/drivers/net/intel/ixgbe/ixgbe_vf_representor.c
index 901d80e406..52b43530c0 100644
--- a/drivers/net/intel/ixgbe/ixgbe_vf_representor.c
+++ b/drivers/net/intel/ixgbe/ixgbe_vf_representor.c
@@ -14,4 +14,13 @@
 #include "rte_pmd_ixgbe.h"
 
+static struct rte_eth_dev *
+ixgbe_vf_representor_pf_get(const struct ixgbe_vf_representor *representor)
+{
+	if (!rte_eth_dev_is_valid_port(representor->pf_port_id))
+		return NULL;
+
+	return &rte_eth_devices[representor->pf_port_id];
+}
+
 
 static int
@@ -20,6 +29,10 @@ ixgbe_vf_representor_link_update(struct rte_eth_dev *ethdev,
 {
 	struct ixgbe_vf_representor *representor = ethdev->data->dev_private;
+	struct rte_eth_dev *pf_ethdev = ixgbe_vf_representor_pf_get(representor);
 
-	return ixgbe_dev_link_update_share(representor->pf_ethdev,
+	if (pf_ethdev == NULL)
+		return -ENODEV;
+
+	return ixgbe_dev_link_update_share(pf_ethdev,
 		wait_to_complete, 0);
 }
@@ -30,7 +43,11 @@ ixgbe_vf_representor_mac_addr_set(struct rte_eth_dev *ethdev,
 {
 	struct ixgbe_vf_representor *representor = ethdev->data->dev_private;
+	struct rte_eth_dev *pf_ethdev = ixgbe_vf_representor_pf_get(representor);
+
+	if (pf_ethdev == NULL)
+		return -ENODEV;
 
 	return rte_pmd_ixgbe_set_vf_mac_addr(
-		representor->pf_ethdev->data->port_id,
+		pf_ethdev->data->port_id,
 		representor->vf_id, mac_addr);
 }
@@ -41,9 +58,12 @@ ixgbe_vf_representor_dev_infos_get(struct rte_eth_dev *ethdev,
 {
 	struct ixgbe_vf_representor *representor = ethdev->data->dev_private;
+	struct rte_eth_dev *pf_ethdev = ixgbe_vf_representor_pf_get(representor);
 
-	struct ixgbe_hw *hw = IXGBE_DEV_PRIVATE_TO_HW(
-		representor->pf_ethdev->data->dev_private);
+	if (pf_ethdev == NULL)
+		return -ENODEV;
 
-	dev_info->device = representor->pf_ethdev->device;
+	struct ixgbe_hw *hw = IXGBE_DEV_PRIVATE_TO_HW(pf_ethdev->data->dev_private);
+
+	dev_info->device = pf_ethdev->device;
 
 	dev_info->min_rx_bufsize = 1024;
@@ -71,9 +91,9 @@ ixgbe_vf_representor_dev_infos_get(struct rte_eth_dev *ethdev,
 
 	dev_info->speed_capa =
-		representor->pf_ethdev->data->dev_link.link_speed;
+		pf_ethdev->data->dev_link.link_speed;
 	/**< Supported speeds bitmap (RTE_ETH_LINK_SPEED_). */
 
 	dev_info->switch_info.name =
-		representor->pf_ethdev->device->name;
+		pf_ethdev->device->name;
 	dev_info->switch_info.domain_id = representor->switch_domain_id;
 	dev_info->switch_info.port_id = representor->vf_id;
@@ -124,8 +144,12 @@ ixgbe_vf_representor_vlan_filter_set(struct rte_eth_dev *ethdev,
 {
 	struct ixgbe_vf_representor *representor = ethdev->data->dev_private;
+	struct rte_eth_dev *pf_ethdev = ixgbe_vf_representor_pf_get(representor);
 	uint64_t vf_mask = 1ULL << representor->vf_id;
 
+	if (pf_ethdev == NULL)
+		return -ENODEV;
+
 	return rte_pmd_ixgbe_set_vf_vlan_filter(
-		representor->pf_ethdev->data->port_id, vlan_id, vf_mask, on);
+		pf_ethdev->data->port_id, vlan_id, vf_mask, on);
 }
 
@@ -135,6 +159,10 @@ ixgbe_vf_representor_vlan_strip_queue_set(struct rte_eth_dev *ethdev,
 {
 	struct ixgbe_vf_representor *representor = ethdev->data->dev_private;
+	struct rte_eth_dev *pf_ethdev = ixgbe_vf_representor_pf_get(representor);
 
-	rte_pmd_ixgbe_set_vf_vlan_stripq(representor->pf_ethdev->data->port_id,
+	if (pf_ethdev == NULL)
+		return;
+
+	rte_pmd_ixgbe_set_vf_vlan_stripq(pf_ethdev->data->port_id,
 		representor->vf_id, on);
 }
@@ -176,4 +204,5 @@ ixgbe_vf_representor_init(struct rte_eth_dev *ethdev, void *init_params)
 {
 	struct ixgbe_vf_representor *representor = ethdev->data->dev_private;
+	struct rte_eth_dev *pf_ethdev;
 
 	struct ixgbe_vf_info *vf_data;
@@ -188,8 +217,12 @@ ixgbe_vf_representor_init(struct rte_eth_dev *ethdev, void *init_params)
 	representor->switch_domain_id =
 		((struct ixgbe_vf_representor *)init_params)->switch_domain_id;
-	representor->pf_ethdev =
-		((struct ixgbe_vf_representor *)init_params)->pf_ethdev;
+	representor->pf_port_id =
+		((struct ixgbe_vf_representor *)init_params)->pf_port_id;
 
-	pci_dev = RTE_ETH_DEV_TO_PCI(representor->pf_ethdev);
+	pf_ethdev = ixgbe_vf_representor_pf_get(representor);
+	if (pf_ethdev == NULL)
+		return -ENODEV;
+
+	pci_dev = RTE_ETH_DEV_TO_PCI(pf_ethdev);
 
 	if (representor->vf_id >= pci_dev->max_vfs)
@@ -198,5 +231,5 @@ ixgbe_vf_representor_init(struct rte_eth_dev *ethdev, void *init_params)
 	ethdev->data->dev_flags |= RTE_ETH_DEV_REPRESENTOR;
 	ethdev->data->representor_id = representor->vf_id;
-	ethdev->data->backer_port_id = representor->pf_ethdev->data->port_id;
+	ethdev->data->backer_port_id = pf_ethdev->data->port_id;
 
 	/* Set representor device ops */
@@ -215,5 +248,5 @@ ixgbe_vf_representor_init(struct rte_eth_dev *ethdev, void *init_params)
 	/* Reference VF mac address from PF data structure */
 	vf_data = *IXGBE_DEV_PRIVATE_TO_P_VFDATA(
-		representor->pf_ethdev->data->dev_private);
+		pf_ethdev->data->dev_private);
 
 	ethdev->data->mac_addrs = (struct rte_ether_addr *)
@@ -221,5 +254,5 @@ ixgbe_vf_representor_init(struct rte_eth_dev *ethdev, void *init_params)
 
 	/* Link state. Inherited from PF */
-	link = &representor->pf_ethdev->data->dev_link;
+	link = &pf_ethdev->data->dev_link;
 
 	ethdev->data->dev_link.link_speed = link->link_speed;
-- 
2.55.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-23 17:57:59.903759755 +0100
+++ 0043-net-ixgbe-fix-shared-PF-pointer-in-representor.patch	2026-07-23 17:57:58.655918600 +0100
@@ -1 +1 @@
-From 31cb98b1f275cf78d9e8d7fb46ee4f38b59186fc Mon Sep 17 00:00:00 2001
+From 25c947267d6fb6be7c0f7a4eeb76e8f5a535d710 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 31cb98b1f275cf78d9e8d7fb46ee4f38b59186fc ]
+
@@ -18 +19,0 @@
-Cc: stable at dpdk.org
@@ -29 +30 @@
-index 9454cbee0a..5c95507d60 100644
+index 990257dc05..7bfb8f1fed 100644
@@ -32 +33 @@
-@@ -1819,5 +1819,5 @@ eth_ixgbe_pci_probe(struct rte_pci_driver *pci_drv __rte_unused,
+@@ -1825,5 +1825,5 @@ eth_ixgbe_pci_probe(struct rte_pci_driver *pci_drv __rte_unused,
@@ -40 +41 @@
-index 38d476d309..1293ea49cb 100644
+index 2e1b94a483..28ba1680c3 100644
@@ -43 +44 @@
-@@ -519,5 +519,5 @@ struct ixgbe_vf_representor {
+@@ -535,5 +535,5 @@ struct ixgbe_vf_representor {