patch 'net/bnxt: fix VNIC filter list walk stopping early' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 10/29/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/93b5aaa93b7c89e0161a6bf6a4acd4f8c42a26a9

Thanks.

Luca Boccassi

---
>From 93b5aaa93b7c89e0161a6bf6a4acd4f8c42a26a9 Mon Sep 17 00:00:00 2001
From: Mohammad Shuab Siddique <mohammad-shuab.siddique at broadcom.com>
Date: Tue, 29 Sep 2026 12:04:18 -0600
Subject: [PATCH] net/bnxt: fix VNIC filter list walk stopping early

[ upstream commit d9f372bf8d713db351ad1dab8ee1b0cac6170a07 ]

bnxt_clear_hwrm_vnic_filters() used STAILQ_FOREACH() to walk
vnic->filter, clearing and freeing each filter as it went. This is
not a use-after-free: bnxt_free_filter() never actually releases the
underlying memory, it memsets the filter object (clearing its next
link too) and returns it to bp->free_filter_list for reuse, so the
object stays live and mapped.

The real bug is that memset() zeroing the filter's next field means
STAILQ_FOREACH()'s own advance step sees a NULL next pointer after
the first filter is freed, so the loop silently stops after removing
just one filter. Every other filter still linked in vnic->filter is
leaked: its hardware entry is never cleared and the filter object
itself never makes it back onto bp->free_filter_list.

Walk the list with STAILQ_FOREACH_SAFE(), which captures each
filter's next pointer before the body runs, so the walk does not
depend on a freed-and-reused object's link field. Each filter is
still unlinked from vnic->filter with STAILQ_REMOVE_HEAD() before
being freed.

Fixes: 20ef524432dd ("net/bnxt: set L2 filters")

Signed-off-by: Mohammad Shuab Siddique <mohammad-shuab.siddique at broadcom.com>
---
 drivers/net/bnxt/bnxt_hwrm.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/bnxt/bnxt_hwrm.c b/drivers/net/bnxt/bnxt_hwrm.c
index 1cf88bbc73a..056dfba4098 100644
--- a/drivers/net/bnxt/bnxt_hwrm.c
+++ b/drivers/net/bnxt/bnxt_hwrm.c
@@ -3606,9 +3606,10 @@ bnxt_clear_hwrm_vnic_filters(struct bnxt *bp, struct bnxt_vnic_info *vnic)
 	struct bnxt_filter_info *filter;
 	int rc = 0;
 
-	STAILQ_FOREACH(filter, &vnic->filter, next) {
+	while (!STAILQ_EMPTY(&vnic->filter)) {
+		filter = STAILQ_FIRST(&vnic->filter);
 		rc = bnxt_clear_one_vnic_filter(bp, filter);
-		STAILQ_REMOVE(&vnic->filter, filter, bnxt_filter_info, next);
+		STAILQ_REMOVE_HEAD(&vnic->filter, next);
 		bnxt_free_filter(bp, filter);
 	}
 	return rc;
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-10-27 11:43:59.987206333 +0000
+++ 0163-net-bnxt-fix-VNIC-filter-list-walk-stopping-early.patch	2026-10-27 11:43:53.734066258 +0000
@@ -1 +1 @@
-From d9f372bf8d713db351ad1dab8ee1b0cac6170a07 Mon Sep 17 00:00:00 2001
+From 93b5aaa93b7c89e0161a6bf6a4acd4f8c42a26a9 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit d9f372bf8d713db351ad1dab8ee1b0cac6170a07 ]
+
@@ -27 +28,0 @@
-Cc: stable at dpdk.org
@@ -35 +36 @@
-index 45e3b901ea..d533965217 100644
+index 1cf88bbc73a..056dfba4098 100644
@@ -38 +39 @@
-@@ -3590,9 +3590,10 @@ bnxt_clear_hwrm_vnic_filters(struct bnxt *bp, struct bnxt_vnic_info *vnic)
+@@ -3606,9 +3606,10 @@ bnxt_clear_hwrm_vnic_filters(struct bnxt *bp, struct bnxt_vnic_info *vnic)