Re: [PATCH v2] net/bnxt: fix flow create segfault

[Stephen Hemminger <stephen@networkplumber.org>]

On Sun, 20 Sep 2026 20:18:17 -0600
Mohammad Shuab Siddique <mohammad-shuab.siddique@broadcom.com> wrote:

> From: Mohammad Shuab Siddique <mohammad-shuab.siddique@broadcom.com>
> 
> When creating a flow that requires a destination queue but none is
> specified in the flow create command, find_matching_vnic() returns
> NULL and the code falls through to insert the new filter into
> vnic->filter, dereferencing the NULL vnic and causing a segfault.
> 
> Check for a NULL vnic and reject the flow create with a clear error
> instead of crashing.
> 
> Fixes: 59119d49529e ("net/bnxt: fix flow create when RSS is disabled")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Dakota Sicher <dakota.sicher@broadcom.com>
> Signed-off-by: Mohammad Shuab Siddique <mohammad-shuab.siddique@broadcom.com>
> ---

Better AI review flagged an error here:

[PATCH v2] net/bnxt: fix flow create segfault

Error: new vnic == NULL branch corrupts filter lists when
update_flow is set.

When bnxt_match_filter() returns -EXDEV it has already done
STAILQ_INSERT_TAIL(&vnic->filter, nf, next) on the existing vnic and
set flow->filter = nf for the existing flow. If find_matching_vnic()
then returns NULL, the new branch calls bnxt_clear_one_vnic_filter()
and bnxt_free_filter() on that same nf. bnxt_free_filter() memsets
it and links it onto bp->free_filter_list while it is still on
vnic->filter. The existing flow is left pointing at a recycled filter
whose HW filter was just deleted. Before this patch the update_flow
path went to free_flow without touching vnic. Gate the new check on
!update_flow, or handle update_flow first.