patch 'net/gve: set mbuf to null in software ring after use' has been queued to stable release 25.11.3

[Kevin Traynor]

Hi,

FYI, your patch has been queued to stable release 25.11.3

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 08/04/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/c19c6eb8ec736a9b8be9e9b2bd0a1e9e1b004a39

Thanks.

Kevin

---
>From c19c6eb8ec736a9b8be9e9b2bd0a1e9e1b004a39 Mon Sep 17 00:00:00 2001
From: Joshua Washington <joshwash at google.com>
Date: Wed, 8 Jul 2026 21:07:33 -0700
Subject: [PATCH] net/gve: set mbuf to null in software ring after use

[ upstream commit 3ca4cbcc74defdba608a6cafb058ca0a71ab4de0 ]

Currently, it is possible for mbufs to be uncleared in the sw_ring after
being returned to the application. This causes an erroneous
dual-ownership over the buffer until GVE cleans the buffer queue and
posts new mbufs, overwriting the older pointers. It is possible in such
a case for a double free to occur while tearing down rings, as both
the application and the driver could attempt to free the same mbuf.
Release ownership of the mbuf from the sw_ring as soon as appropriate to
avoid such a scenario.

Fixes: a46583cf43c8 ("net/gve: support Rx/Tx")
Fixes: 45da16b5b181 ("net/gve: support basic Rx data path for DQO")

Signed-off-by: Joshua Washington <joshwash at google.com>
Reviewed-by: Jasper Tran O'Leary <jtranoleary at google.com>
---
 drivers/net/gve/gve_rx.c     | 1 +
 drivers/net/gve/gve_rx_dqo.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/net/gve/gve_rx.c b/drivers/net/gve/gve_rx.c
index 7a91c31ad2..a151a9dfe2 100644
--- a/drivers/net/gve/gve_rx.c
+++ b/drivers/net/gve/gve_rx.c
@@ -153,4 +153,5 @@ gve_rx(struct gve_rx_queue *rxq, volatile struct gve_rx_desc *rxd, uint16_t rx_i
 	rxe = rxq->sw_ring[rx_id];
 	gve_rx_mbuf(rxq, rxe, frag_size, rx_id);
+	rxq->sw_ring[rx_id] = NULL;
 	rxq->stats.bytes += frag_size;
 
diff --git a/drivers/net/gve/gve_rx_dqo.c b/drivers/net/gve/gve_rx_dqo.c
index c1544418b9..3e8aa78149 100644
--- a/drivers/net/gve/gve_rx_dqo.c
+++ b/drivers/net/gve/gve_rx_dqo.c
@@ -195,4 +195,5 @@ gve_rx_burst_dqo(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t nb_pkts)
 		rxm = rxq->sw_ring[rx_buf_id];
 		gve_completed_buf_list_push(rxq, rx_buf_id);
+		rxq->sw_ring[rx_buf_id] = NULL;
 
 		/* Free buffer and report error. */
-- 
2.55.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-30 10:16:02.828293677 +0100
+++ 0046-net-gve-set-mbuf-to-null-in-software-ring-after-use.patch	2026-07-30 10:16:01.483587382 +0100
@@ -1 +1 @@
-From 3ca4cbcc74defdba608a6cafb058ca0a71ab4de0 Mon Sep 17 00:00:00 2001
+From c19c6eb8ec736a9b8be9e9b2bd0a1e9e1b004a39 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 3ca4cbcc74defdba608a6cafb058ca0a71ab4de0 ]
+
@@ -17 +18,0 @@
-Cc: stable at dpdk.org
@@ -27 +28 @@
-index 625649cdcf..cda87af294 100644
+index 7a91c31ad2..a151a9dfe2 100644
@@ -37 +38 @@
-index c4e2d32067..3665d9e4cd 100644
+index c1544418b9..3e8aa78149 100644
@@ -40 +41 @@
-@@ -208,4 +208,5 @@ gve_rx_burst_dqo(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t nb_pkts)
+@@ -195,4 +195,5 @@ gve_rx_burst_dqo(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t nb_pkts)