patch 'net/bnxt: fix bounds in MAC address pool index' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 10/29/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/9e1f75b6359398ec09d9044558d2ab014afdf906

Thanks.

Luca Boccassi

---
>From 9e1f75b6359398ec09d9044558d2ab014afdf906 Mon Sep 17 00:00:00 2001
From: Chenna Arnoori <chenna.arnoori at broadcom.com>
Date: Tue, 29 Sep 2026 12:04:08 -0600
Subject: [PATCH] net/bnxt: fix bounds in MAC address pool index

[ upstream commit 1504663a322b8cdf2307afcefca44478ebbe83a9 ]

bnxt_mac_addr_add_op() indexed bp->vnic_info[pool] with a
caller-supplied pool before validating it against bp->max_vnics, and
before checking bp->vnic_info was even allocated yet (it is NULL
until the port is started). The existing "if (!vnic)" check was
always false, since vnic held the address of an array element and
is never NULL. bp->max_vnics is known from probe onward, so the pool
bound is checked first and unconditionally; the dev_started and
vnic_info checks, which gate whether there is anything to index yet,
follow it.

Fixes: 51fafb89a9a0 ("net/bnxt: get rid of ff pools and use VNIC info array")

Signed-off-by: Chenna Arnoori <chenna.arnoori at broadcom.com>
Signed-off-by: Mohammad Shuab Siddique <mohammad-shuab.siddique at broadcom.com>
---
 drivers/net/bnxt/bnxt_ethdev.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/net/bnxt/bnxt_ethdev.c b/drivers/net/bnxt/bnxt_ethdev.c
index 0657ac4f7f6..88be4322dda 100644
--- a/drivers/net/bnxt/bnxt_ethdev.c
+++ b/drivers/net/bnxt/bnxt_ethdev.c
@@ -2051,7 +2051,7 @@ static int bnxt_mac_addr_add_op(struct rte_eth_dev *eth_dev,
 				uint32_t index, uint32_t pool)
 {
 	struct bnxt *bp = eth_dev->data->dev_private;
-	struct bnxt_vnic_info *vnic = &bp->vnic_info[pool];
+	struct bnxt_vnic_info *vnic;
 	int rc = 0;
 
 	rc = is_bnxt_in_error(bp);
@@ -2063,8 +2063,8 @@ static int bnxt_mac_addr_add_op(struct rte_eth_dev *eth_dev,
 		return -ENOTSUP;
 	}
 
-	if (!vnic) {
-		PMD_DRV_LOG_LINE(ERR, "VNIC not found for pool %d!", pool);
+	if (pool >= bp->max_vnics) {
+		PMD_DRV_LOG_LINE(ERR, "Pool %u exceeds VNIC count %u!", pool, bp->max_vnics);
 		return -EINVAL;
 	}
 
@@ -2072,6 +2072,11 @@ static int bnxt_mac_addr_add_op(struct rte_eth_dev *eth_dev,
 	if (!eth_dev->data->dev_started)
 		return 0;
 
+	if (bp->vnic_info == NULL)
+		return 0;
+
+	vnic = &bp->vnic_info[pool];
+
 	rc = bnxt_add_mac_filter(bp, vnic, mac_addr, index, pool);
 
 	return rc;
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-10-27 11:43:59.827780965 +0000
+++ 0159-net-bnxt-fix-bounds-in-MAC-address-pool-index.patch	2026-10-27 11:43:53.718065762 +0000
@@ -1 +1 @@
-From 1504663a322b8cdf2307afcefca44478ebbe83a9 Mon Sep 17 00:00:00 2001
+From 9e1f75b6359398ec09d9044558d2ab014afdf906 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 1504663a322b8cdf2307afcefca44478ebbe83a9 ]
+
@@ -17 +18,0 @@
-Cc: stable at dpdk.org
@@ -26 +27 @@
-index 11e8f7908d..20084826d3 100644
+index 0657ac4f7f6..88be4322dda 100644
@@ -29 +30 @@
-@@ -2105,7 +2105,7 @@ static int bnxt_mac_addr_add_op(struct rte_eth_dev *eth_dev,
+@@ -2051,7 +2051,7 @@ static int bnxt_mac_addr_add_op(struct rte_eth_dev *eth_dev,
@@ -38 +39 @@
-@@ -2117,8 +2117,8 @@ static int bnxt_mac_addr_add_op(struct rte_eth_dev *eth_dev,
+@@ -2063,8 +2063,8 @@ static int bnxt_mac_addr_add_op(struct rte_eth_dev *eth_dev,
@@ -49 +50 @@
-@@ -2126,6 +2126,11 @@ static int bnxt_mac_addr_add_op(struct rte_eth_dev *eth_dev,
+@@ -2072,6 +2072,11 @@ static int bnxt_mac_addr_add_op(struct rte_eth_dev *eth_dev,