patch 'net/bnxt: fix crash when creating invalid flow' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 10/29/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/eac6824c187375ca548b110b93664891f662c3dd

Thanks.

Luca Boccassi

---
>From eac6824c187375ca548b110b93664891f662c3dd Mon Sep 17 00:00:00 2001
From: Mohammad Shuab Siddique <mohammad-shuab.siddique at broadcom.com>
Date: Tue, 29 Sep 2026 12:05:01 -0600
Subject: [PATCH] net/bnxt: fix crash when creating invalid flow

[ upstream commit 8725a84cdf6a30604dc795b5617544eae6be2e89 ]

When creating a flow that requires a destination queue but none is
specified in the flow create command, find_matching_vnic() returns
NULL and the code falls through to insert the new filter into
vnic->filter, dereferencing the NULL vnic and causing a segfault.

Reject a flow create with no destination up front, right after
bnxt_validate_and_parse_flow() and before bnxt_match_filter() is
called (skipped for HWRM_CFA_TUNNEL_REDIRECT_FILTER, which has no
destination VNIC by design). Checking this only after
bnxt_match_filter() is not enough: when the new filter's pattern
matches an already-installed flow with a different destination,
bnxt_match_filter() unlinks that flow's old filter, links the new
(about-to-be-rejected) one in its place, frees the old filter, and
repoints the existing flow's flow->filter at the new one, all before
returning -EXDEV. Rejecting the missing-destination case afterward
then frees that same new filter while it is still linked into
vnic->filter and still referenced by the pre-existing flow, leaving
that unrelated flow's HW filter deleted and flow->filter pointing at
freed memory. Checking before bnxt_match_filter() ever runs avoids
triggering that mutation in the first place.

Fixes: 59119d49529e ("net/bnxt: fix flow create when RSS is disabled")

Signed-off-by: Dakota Sicher <dakota.sicher at broadcom.com>
Signed-off-by: Mohammad Shuab Siddique <mohammad-shuab.siddique at broadcom.com>
---
 drivers/net/bnxt/bnxt_flow.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/net/bnxt/bnxt_flow.c b/drivers/net/bnxt/bnxt_flow.c
index 63cfa3a045a..bffa8efc012 100644
--- a/drivers/net/bnxt/bnxt_flow.c
+++ b/drivers/net/bnxt/bnxt_flow.c
@@ -2049,6 +2049,16 @@ bnxt_flow_create(struct rte_eth_dev *dev,
 	if (ret != 0)
 		goto free_filter;
 
+	if (filter->filter_type != HWRM_CFA_TUNNEL_REDIRECT_FILTER &&
+	    find_matching_vnic(bp, filter) == NULL) {
+		rte_flow_error_set(error, EINVAL,
+				   RTE_FLOW_ERROR_TYPE_HANDLE, NULL,
+				   "Missing destination action for flow.");
+		bnxt_hwrm_clear_l2_filter(bp, filter);
+		ret = -EINVAL;
+		goto free_filter;
+	}
+
 	ret = bnxt_match_filter(bp, filter);
 	if (ret == -EEXIST) {
 		PMD_DRV_LOG_LINE(DEBUG, "Flow already exists.");
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-10-27 11:44:00.096438612 +0000
+++ 0166-net-bnxt-fix-crash-when-creating-invalid-flow.patch	2026-10-27 11:43:53.742066506 +0000
@@ -1 +1 @@
-From 8725a84cdf6a30604dc795b5617544eae6be2e89 Mon Sep 17 00:00:00 2001
+From eac6824c187375ca548b110b93664891f662c3dd Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 8725a84cdf6a30604dc795b5617544eae6be2e89 ]
+
@@ -28 +29,0 @@
-Cc: stable at dpdk.org
@@ -37 +38 @@
-index 7a46604cb6..c500890ce7 100644
+index 63cfa3a045a..bffa8efc012 100644
@@ -40 +41 @@
-@@ -2043,6 +2043,16 @@ bnxt_flow_create(struct rte_eth_dev *dev,
+@@ -2049,6 +2049,16 @@ bnxt_flow_create(struct rte_eth_dev *dev,