patch 'net/bnxt/tf_core: fix CPM pool-use list insertion' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 10/29/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/b56f84678092abc504eff8ac965dcd96417872a6

Thanks.

Luca Boccassi

---
>From b56f84678092abc504eff8ac965dcd96417872a6 Mon Sep 17 00:00:00 2001
From: Manish Kurup <manish.kurup at broadcom.com>
Date: Mon, 5 Oct 2026 10:16:39 -0500
Subject: [PATCH] net/bnxt/tf_core: fix CPM pool-use list insertion

[ upstream commit dd929057e33fff3a722ef9491c49aa822cf4f782 ]

cpm_insert_pool_id() builds the initial list entry when a pool is
registered (tfc_cpm_set_cmm_inst()). It contains two bugs in the
loop/insert logic.

Bug 1: prev advances in lockstep with pool_use. prev is supposed to
track the node *before* pool_use so that the "within list" case can
insert between them. Instead, after each iteration prev == pool_use
(both point to the same node), but the more damaging case occurs when
the loop exhausts the list: pool_use advances to NULL, and then prev
is set to that NULL too, instead of pointing to the last real node.
This caused the "empty list" branch to fire even on a non-empty list,
overwriting cpm->pool_use_list and silently losing all existing nodes
(a list-head clobber on tail insert). Add an explicit "insert at tail"
case to fix this.

Bug 2: missing backward link in the "within list" case. pool_use->prev
was left pointing at prev (the old predecessor) instead of being
updated to new_pool_use, corrupting the backward linkage of the list.

Fixes: 80317ff6adfd ("net/bnxt/tf_core: support Thor2")

Signed-off-by: Manish Kurup <manish.kurup at broadcom.com>
---
 drivers/net/bnxt/tf_core/v3/tfc_cpm.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/net/bnxt/tf_core/v3/tfc_cpm.c b/drivers/net/bnxt/tf_core/v3/tfc_cpm.c
index 6af1368c7af..9fe45deb16f 100644
--- a/drivers/net/bnxt/tf_core/v3/tfc_cpm.c
+++ b/drivers/net/bnxt/tf_core/v3/tfc_cpm.c
@@ -83,8 +83,8 @@ static int cpm_insert_pool_id(struct tfc_cpm *cpm, uint16_t pool_id)
 		if (cpm->pools[pool_use->pool_id].valid &&
 			cpm->pools[pool_use->pool_id].used_count >
 			pool->used_count) {
-			pool_use = pool_use->next;
 			prev =	pool_use;
+			pool_use = pool_use->next;
 		} else {
 			break;
 		}
@@ -101,16 +101,20 @@ static int cpm_insert_pool_id(struct tfc_cpm *cpm, uint16_t pool_id)
 	new_pool_use->next = NULL;
 	pool->pool_use = new_pool_use;
 
-	if (pool_use == NULL) { /* Empty list */
+	if (pool_use == NULL && prev == NULL) { /* Empty list */
 		cpm->pool_use_list = new_pool_use;
-	} else if (prev == NULL) { /* Start of list */
+	} else if (pool_use == NULL) { /* Insert at tail */
+		prev->next = new_pool_use;
+		new_pool_use->prev = prev;
+	} else if (prev == NULL) { /* Insert at head */
 		cpm->pool_use_list = new_pool_use;
 		new_pool_use->next = pool_use;
 		pool_use->prev = new_pool_use;
-	} else { /* Within list */
+	} else { /* Insert in middle */
 		prev->next = new_pool_use;
 		new_pool_use->next = pool_use;
 		new_pool_use->prev = prev;
+		pool_use->prev = new_pool_use;
 	}
 
 	cpm->available_pool_id = cpm->pool_use_list->pool_id;
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-10-27 11:44:00.278914242 +0000
+++ 0171-net-bnxt-tf_core-fix-CPM-pool-use-list-insertion.patch	2026-10-27 11:43:53.754066877 +0000
@@ -1 +1 @@
-From dd929057e33fff3a722ef9491c49aa822cf4f782 Mon Sep 17 00:00:00 2001
+From b56f84678092abc504eff8ac965dcd96417872a6 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit dd929057e33fff3a722ef9491c49aa822cf4f782 ]
+
@@ -26 +27,0 @@
-Cc: stable at dpdk.org
@@ -34 +35 @@
-index 8d95a0c205..f2c14fa8b8 100644
+index 6af1368c7af..9fe45deb16f 100644