patch 'net/bnxt: avoid null Rx queue dereference' has been queued to stable release 24.11.7

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.7

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 06/13/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/eea4bd5f4a62ccba43ffc5860526a979e09fac1e

Thanks.

Luca Boccassi

---
>From eea4bd5f4a62ccba43ffc5860526a979e09fac1e Mon Sep 17 00:00:00 2001
From: Ajit Khaparde <ajit.khaparde at broadcom.com>
Date: Thu, 9 Oct 2025 13:54:39 -0700
Subject: [PATCH] net/bnxt: avoid null Rx queue dereference

[ upstream commit 52345a125a2833b2c1fa0553942d73040601d952 ]

Add checks to prevent a segfault while accessing members of
structures which may not have been initialized yet.

Fixes: 1b7ceba3e375 ("net/bnxt: support Rx queue count")

Signed-off-by: Ajit Khaparde <ajit.khaparde at broadcom.com>
Signed-off-by: Mohammad Shuab Siddique <mohammad-shuab.siddique at broadcom.com>
---
 drivers/net/bnxt/bnxt_ethdev.c |  3 +++
 drivers/net/bnxt/bnxt_hwrm.c   |  3 +++
 drivers/net/bnxt/bnxt_ring.c   | 11 ++++++++++-
 3 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/drivers/net/bnxt/bnxt_ethdev.c b/drivers/net/bnxt/bnxt_ethdev.c
index d90a418f2c..b921ee17ad 100644
--- a/drivers/net/bnxt/bnxt_ethdev.c
+++ b/drivers/net/bnxt/bnxt_ethdev.c
@@ -1432,6 +1432,9 @@ static int bnxt_scattered_rx(struct rte_eth_dev *eth_dev)
 	for (i = 0; i < eth_dev->data->nb_rx_queues; i++) {
 		struct bnxt_rx_queue *rxq = eth_dev->data->rx_queues[i];
 
+		if (rxq == NULL)
+			continue;
+
 		buf_size = (uint16_t)(rte_pktmbuf_data_room_size(rxq->mb_pool) -
 				      RTE_PKTMBUF_HEADROOM);
 		if (eth_dev->data->mtu + overhead > buf_size)
diff --git a/drivers/net/bnxt/bnxt_hwrm.c b/drivers/net/bnxt/bnxt_hwrm.c
index e34929515e..f438770860 100644
--- a/drivers/net/bnxt/bnxt_hwrm.c
+++ b/drivers/net/bnxt/bnxt_hwrm.c
@@ -3344,6 +3344,9 @@ bnxt_free_all_hwrm_stat_ctxs(struct bnxt *bp)
 
 	for (i = 0; i < bp->rx_cp_nr_rings; i++) {
 
+		if (bp->rx_queues[i] == NULL)
+			continue;
+
 		cpr = bp->rx_queues[i]->cp_ring;
 		if (BNXT_HAS_RING_GRPS(bp))
 			bp->grp_info[i].fw_stats_ctx = -1;
diff --git a/drivers/net/bnxt/bnxt_ring.c b/drivers/net/bnxt/bnxt_ring.c
index b6d411a931..32a972dd88 100644
--- a/drivers/net/bnxt/bnxt_ring.c
+++ b/drivers/net/bnxt/bnxt_ring.c
@@ -696,6 +696,9 @@ static void bnxt_init_all_rings(struct bnxt *bp)
 
 	for (i = 0; i < bp->rx_cp_nr_rings; i++) {
 		rxq = bp->rx_queues[i];
+
+		if (rxq == NULL)
+			continue;
 		/* Rx-compl */
 		cp_ring = rxq->cp_ring->cp_ring_struct;
 		cp_ring->fw_ring_id = INVALID_HW_RING_ID;
@@ -738,9 +741,15 @@ int bnxt_alloc_hwrm_rings(struct bnxt *bp)
 	for (i = 0; i < bp->rx_cp_nr_rings; i++) {
 		unsigned int soc_id = bp->eth_dev->device->numa_node;
 		struct bnxt_rx_queue *rxq  = bp->rx_queues[i];
-		struct bnxt_rx_ring_info *rxr = rxq->rx_ring;
+		struct bnxt_rx_ring_info *rxr;
 		struct bnxt_ring *ring;
 
+
+		if (rxq == NULL)
+			return -EINVAL;
+
+		rxr = rxq->rx_ring;
+
 		if (bnxt_need_agg_ring(bp->eth_dev)) {
 			ring = rxr->ag_ring_struct;
 			if (ring == NULL) {
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-06-11 14:20:05.651170833 +0100
+++ 0110-net-bnxt-avoid-null-Rx-queue-dereference.patch	2026-06-11 14:20:01.374749871 +0100
@@ -1 +1 @@
-From 52345a125a2833b2c1fa0553942d73040601d952 Mon Sep 17 00:00:00 2001
+From eea4bd5f4a62ccba43ffc5860526a979e09fac1e Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 52345a125a2833b2c1fa0553942d73040601d952 ]
+
@@ -10 +11,0 @@
-Cc: stable at dpdk.org
@@ -21 +22 @@
-index 6357098d1d..fae67d75d0 100644
+index d90a418f2c..b921ee17ad 100644
@@ -24 +25 @@
-@@ -1435,6 +1435,9 @@ static int bnxt_scattered_rx(struct rte_eth_dev *eth_dev)
+@@ -1432,6 +1432,9 @@ static int bnxt_scattered_rx(struct rte_eth_dev *eth_dev)
@@ -35 +36 @@
-index e4ae27d3f4..02a5d00738 100644
+index e34929515e..f438770860 100644
@@ -38 +39 @@
-@@ -3328,6 +3328,9 @@ bnxt_free_all_hwrm_stat_ctxs(struct bnxt *bp)
+@@ -3344,6 +3344,9 @@ bnxt_free_all_hwrm_stat_ctxs(struct bnxt *bp)
@@ -49 +50 @@
-index 579b73d2ce..064520aa62 100644
+index b6d411a931..32a972dd88 100644
@@ -52 +53 @@
-@@ -723,6 +723,9 @@ static void bnxt_init_all_rings(struct bnxt *bp)
+@@ -696,6 +696,9 @@ static void bnxt_init_all_rings(struct bnxt *bp)
@@ -62 +63 @@
-@@ -765,9 +768,15 @@ int bnxt_alloc_hwrm_rings(struct bnxt *bp)
+@@ -738,9 +741,15 @@ int bnxt_alloc_hwrm_rings(struct bnxt *bp)