patch 'net/bnxt: avoid null Rx queue dereference' has been queued to stable release 25.11.3

[Kevin Traynor]

Hi,

FYI, your patch has been queued to stable release 25.11.3

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 08/01/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/de0d0a55b8dc7e9e521f512acafea87f37e3da35

Thanks.

Kevin

---
>From de0d0a55b8dc7e9e521f512acafea87f37e3da35 Mon Sep 17 00:00:00 2001
From: Ajit Khaparde <ajit.khaparde at broadcom.com>
Date: Thu, 9 Oct 2025 13:54:39 -0700
Subject: [PATCH] net/bnxt: avoid null Rx queue dereference

[ upstream commit 52345a125a2833b2c1fa0553942d73040601d952 ]

Add checks to prevent a segfault while accessing members of
structures which may not have been initialized yet.

Fixes: 1b7ceba3e375 ("net/bnxt: support Rx queue count")

Signed-off-by: Ajit Khaparde <ajit.khaparde at broadcom.com>
Signed-off-by: Mohammad Shuab Siddique <mohammad-shuab.siddique at broadcom.com>
---
 drivers/net/bnxt/bnxt_ethdev.c |  3 +++
 drivers/net/bnxt/bnxt_hwrm.c   |  3 +++
 drivers/net/bnxt/bnxt_ring.c   | 11 ++++++++++-
 3 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/drivers/net/bnxt/bnxt_ethdev.c b/drivers/net/bnxt/bnxt_ethdev.c
index 34994302c3..2f36068bd5 100644
--- a/drivers/net/bnxt/bnxt_ethdev.c
+++ b/drivers/net/bnxt/bnxt_ethdev.c
@@ -1436,4 +1436,7 @@ static int bnxt_scattered_rx(struct rte_eth_dev *eth_dev)
 		struct bnxt_rx_queue *rxq = eth_dev->data->rx_queues[i];
 
+		if (rxq == NULL)
+			continue;
+
 		buf_size = (uint16_t)(rte_pktmbuf_data_room_size(rxq->mb_pool) -
 				      RTE_PKTMBUF_HEADROOM);
diff --git a/drivers/net/bnxt/bnxt_hwrm.c b/drivers/net/bnxt/bnxt_hwrm.c
index 8898644afb..41303f7217 100644
--- a/drivers/net/bnxt/bnxt_hwrm.c
+++ b/drivers/net/bnxt/bnxt_hwrm.c
@@ -3342,4 +3342,7 @@ bnxt_free_all_hwrm_stat_ctxs(struct bnxt *bp)
 	for (i = 0; i < bp->rx_cp_nr_rings; i++) {
 
+		if (bp->rx_queues[i] == NULL)
+			continue;
+
 		cpr = bp->rx_queues[i]->cp_ring;
 		if (BNXT_HAS_RING_GRPS(bp))
diff --git a/drivers/net/bnxt/bnxt_ring.c b/drivers/net/bnxt/bnxt_ring.c
index b6d411a931..32a972dd88 100644
--- a/drivers/net/bnxt/bnxt_ring.c
+++ b/drivers/net/bnxt/bnxt_ring.c
@@ -697,4 +697,7 @@ static void bnxt_init_all_rings(struct bnxt *bp)
 	for (i = 0; i < bp->rx_cp_nr_rings; i++) {
 		rxq = bp->rx_queues[i];
+
+		if (rxq == NULL)
+			continue;
 		/* Rx-compl */
 		cp_ring = rxq->cp_ring->cp_ring_struct;
@@ -739,7 +742,13 @@ int bnxt_alloc_hwrm_rings(struct bnxt *bp)
 		unsigned int soc_id = bp->eth_dev->device->numa_node;
 		struct bnxt_rx_queue *rxq  = bp->rx_queues[i];
-		struct bnxt_rx_ring_info *rxr = rxq->rx_ring;
+		struct bnxt_rx_ring_info *rxr;
 		struct bnxt_ring *ring;
 
+
+		if (rxq == NULL)
+			return -EINVAL;
+
+		rxr = rxq->rx_ring;
+
 		if (bnxt_need_agg_ring(bp->eth_dev)) {
 			ring = rxr->ag_ring_struct;
-- 
2.55.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-28 16:54:51.585616052 +0100
+++ 0026-net-bnxt-avoid-null-Rx-queue-dereference.patch	2026-07-28 16:54:50.767728477 +0100
@@ -1 +1 @@
-From 52345a125a2833b2c1fa0553942d73040601d952 Mon Sep 17 00:00:00 2001
+From de0d0a55b8dc7e9e521f512acafea87f37e3da35 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 52345a125a2833b2c1fa0553942d73040601d952 ]
+
@@ -10 +11,0 @@
-Cc: stable at dpdk.org
@@ -21 +22 @@
-index 6357098d1d..fae67d75d0 100644
+index 34994302c3..2f36068bd5 100644
@@ -33 +34 @@
-index e4ae27d3f4..02a5d00738 100644
+index 8898644afb..41303f7217 100644
@@ -36 +37 @@
-@@ -3329,4 +3329,7 @@ bnxt_free_all_hwrm_stat_ctxs(struct bnxt *bp)
+@@ -3342,4 +3342,7 @@ bnxt_free_all_hwrm_stat_ctxs(struct bnxt *bp)
@@ -45 +46 @@
-index 579b73d2ce..064520aa62 100644
+index b6d411a931..32a972dd88 100644
@@ -48 +49 @@
-@@ -724,4 +724,7 @@ static void bnxt_init_all_rings(struct bnxt *bp)
+@@ -697,4 +697,7 @@ static void bnxt_init_all_rings(struct bnxt *bp)
@@ -56 +57 @@
-@@ -766,7 +769,13 @@ int bnxt_alloc_hwrm_rings(struct bnxt *bp)
+@@ -739,7 +742,13 @@ int bnxt_alloc_hwrm_rings(struct bnxt *bp)