patch 'net/iavf: fix crash in TM ops without QoS capability' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 11/07/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/e4a6f0e075aa57718622332c72259b722a9a8e80

Thanks.

Luca Boccassi

---
>From e4a6f0e075aa57718622332c72259b722a9a8e80 Mon Sep 17 00:00:00 2001
From: Dawid Wesierski <dawid.wesierski at intel.com>
Date: Tue, 20 Oct 2026 15:22:12 +0000
Subject: [PATCH] net/iavf: fix crash in TM ops without QoS capability

[ upstream commit 5ab4004453674a3db399e7086e306ab72954c14e ]

The VF allocates qos_cap and initializes the TM lists only when the PF
grants VIRTCHNL_VF_OFFLOAD_QOS. The in-tree ice PF does not grant it.
On such a VF, node add, shaper profile add, capabilities get, and node
capabilities get dereference a NULL qos_cap, or insert into a list that
has no initialization. The application gets a segmentation fault from a
call such as rte_tm_capabilities_get().

Return -ENOTSUP from these operations when qos_cap is NULL. The other
TM operations only search the lists, or check VIRTCHNL_VF_OFFLOAD_QOS
already, so they do not need the check.

Fixes: 44d0a720a538 ("net/iavf: query QoS capabilities and set queue TC mapping")

Signed-off-by: Dawid Wesierski <dawid.wesierski at intel.com>
Acked-by: Bruce Richardson <bruce.richardson at intel.com>
---
 drivers/net/iavf/iavf_tm.c | 37 +++++++++++++++++++++++++++++++++++--
 1 file changed, 35 insertions(+), 2 deletions(-)

diff --git a/drivers/net/iavf/iavf_tm.c b/drivers/net/iavf/iavf_tm.c
index 73e69e8946a..8e860201749 100644
--- a/drivers/net/iavf/iavf_tm.c
+++ b/drivers/net/iavf/iavf_tm.c
@@ -102,6 +102,18 @@ iavf_tm_conf_uninit(struct rte_eth_dev *dev)
 	vf->qtc_map = NULL;
 }
 
+/* qos_cap and the TM lists exist only if the PF grants VIRTCHNL_VF_OFFLOAD_QOS. */
+static int
+iavf_tm_qos_check(struct iavf_info *vf, struct rte_tm_error *error)
+{
+	if (vf->qos_cap != NULL)
+		return 0;
+
+	error->type = RTE_TM_ERROR_TYPE_CAPABILITIES;
+	error->message = "VF has no QoS capability";
+	return -ENOTSUP;
+}
+
 static inline struct iavf_tm_node *
 iavf_tm_node_search(struct rte_eth_dev *dev,
 		    uint32_t node_id, enum iavf_tm_node_type *node_type)
@@ -279,12 +291,18 @@ iavf_tm_node_add(struct rte_eth_dev *dev, uint32_t node_id,
 	struct iavf_tm_shaper_profile *shaper_profile = NULL;
 	struct iavf_tm_node *tm_node;
 	struct iavf_tm_node *parent_node;
-	uint16_t tc_nb = vf->qos_cap->num_elem;
+	uint16_t tc_nb;
 	int ret;
 
 	if (!params || !error)
 		return -EINVAL;
 
+	ret = iavf_tm_qos_check(vf, error);
+	if (ret)
+		return ret;
+
+	tc_nb = vf->qos_cap->num_elem;
+
 	/* if already committed */
 	if (vf->tm_conf.committed) {
 		error->type = RTE_TM_ERROR_TYPE_UNSPECIFIED;
@@ -524,6 +542,10 @@ iavf_shaper_profile_add(struct rte_eth_dev *dev,
 	if (!profile || !error)
 		return -EINVAL;
 
+	ret = iavf_tm_qos_check(vf, error);
+	if (ret)
+		return ret;
+
 	ret = iavf_shaper_profile_param_check(profile, error);
 	if (ret)
 		return ret;
@@ -588,11 +610,17 @@ iavf_tm_capabilities_get(struct rte_eth_dev *dev,
 			 struct rte_tm_error *error)
 {
 	struct iavf_info *vf = IAVF_DEV_PRIVATE_TO_VF(dev->data->dev_private);
-	uint16_t tc_nb = vf->qos_cap->num_elem;
+	uint16_t tc_nb;
+	int ret;
 
 	if (!cap || !error)
 		return -EINVAL;
 
+	ret = iavf_tm_qos_check(vf, error);
+	if (ret)
+		return ret;
+
+	tc_nb = vf->qos_cap->num_elem;
 	if (tc_nb > vf->vf_res->num_queue_pairs)
 		return -EINVAL;
 
@@ -744,10 +772,15 @@ iavf_node_capabilities_get(struct rte_eth_dev *dev,
 	enum iavf_tm_node_type node_type;
 	struct virtchnl_qos_cap_elem tc_cap;
 	struct iavf_tm_node *tm_node;
+	int ret;
 
 	if (!cap || !error)
 		return -EINVAL;
 
+	ret = iavf_tm_qos_check(vf, error);
+	if (ret)
+		return ret;
+
 	if (node_id == RTE_TM_NODE_ID_NULL) {
 		error->type = RTE_TM_ERROR_TYPE_NODE_ID;
 		error->message = "invalid node id";
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-11-05 16:42:46.695602093 +0000
+++ 0044-net-iavf-fix-crash-in-TM-ops-without-QoS-capability.patch	2026-11-05 16:42:44.953061742 +0000
@@ -1 +1 @@
-From 5ab4004453674a3db399e7086e306ab72954c14e Mon Sep 17 00:00:00 2001
+From e4a6f0e075aa57718622332c72259b722a9a8e80 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 5ab4004453674a3db399e7086e306ab72954c14e ]
+
@@ -18 +19,0 @@
-Cc: stable at dpdk.org
@@ -23 +24 @@
- drivers/net/intel/iavf/iavf_tm.c | 37 ++++++++++++++++++++++++++++++--
+ drivers/net/iavf/iavf_tm.c | 37 +++++++++++++++++++++++++++++++++++--
@@ -26,4 +27,4 @@
-diff --git a/drivers/net/intel/iavf/iavf_tm.c b/drivers/net/intel/iavf/iavf_tm.c
-index 57075ee5b8..07ba58f6f5 100644
---- a/drivers/net/intel/iavf/iavf_tm.c
-+++ b/drivers/net/intel/iavf/iavf_tm.c
+diff --git a/drivers/net/iavf/iavf_tm.c b/drivers/net/iavf/iavf_tm.c
+index 73e69e8946a..8e860201749 100644
+--- a/drivers/net/iavf/iavf_tm.c
++++ b/drivers/net/iavf/iavf_tm.c