[PATCH] net/nfp: fix null dereference in flower ctrl NFD3 Tx

[PATCH] net/nfp: fix null dereference in flower ctrl NFD3 Tx

[Denis Sergeev]

In nfp_flower_ctrl_vnic_nfd3_xmit(), when txq is NULL, goto xmit_end
leads to unconditional dereference of txq->qcp_q in nfp_qcp_ptr_add().
The same goto from the "no free descriptors" path incorrectly increments
the hardware write pointer despite no descriptor being written.

Replace both gotos with early return, removing the unused xmit_end label.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: a36634e87e16 ("net/nfp: add flower ctrl VNIC Rx/Tx")
Cc: stable@dpdk.org

Signed-off-by: Denis Sergeev <denserg.edu@gmail.com>
---
 drivers/net/nfp/flower/nfp_flower_ctrl.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/net/nfp/flower/nfp_flower_ctrl.c b/drivers/net/nfp/flower/nfp_flower_ctrl.c
index 6ac2caf367..1fa751a106 100644
--- a/drivers/net/nfp/flower/nfp_flower_ctrl.c
+++ b/drivers/net/nfp/flower/nfp_flower_ctrl.c
@@ -168,7 +168,7 @@ nfp_flower_ctrl_vnic_nfd3_xmit(struct nfp_app_fw_flower *app_fw_flower,
 		 * enabled. But the queue needs to be configured.
 		 */
 		PMD_TX_LOG(ERR, "Ctrl dev TX Bad queue.");
-		goto xmit_end;
+		return 0;
 	}

 	txds = &txq->txds[txq->wr_p];
@@ -183,7 +183,7 @@ nfp_flower_ctrl_vnic_nfd3_xmit(struct nfp_app_fw_flower *app_fw_flower,
 	free_descs = nfp_net_nfd3_free_tx_desc(txq);
 	if (unlikely(free_descs == 0)) {
 		PMD_TX_LOG(ERR, "Ctrl dev no free descs.");
-		goto xmit_end;
+		return 0;
 	}

 	lmbuf = &txq->txbufs[txq->wr_p].mbuf;
@@ -207,7 +207,6 @@ nfp_flower_ctrl_vnic_nfd3_xmit(struct nfp_app_fw_flower *app_fw_flower,
 	cnt++;
 	app_fw_flower->ctrl_vnic_tx_count++;

-xmit_end:
 	rte_wmb();
 	nfp_qcp_ptr_add(txq->qcp_q, NFP_QCP_WRITE_PTR, 1);

--
2.50.1

Re: [PATCH] net/nfp: fix null dereference in flower ctrl NFD3 Tx

[Stephen Hemminger]

On Wed,  3 Jun 2026 08:51:56 +0300
Denis Sergeev <denserg.edu@gmail.com> wrote:

> In nfp_flower_ctrl_vnic_nfd3_xmit(), when txq is NULL, goto xmit_end
> leads to unconditional dereference of txq->qcp_q in nfp_qcp_ptr_add().
> The same goto from the "no free descriptors" path incorrectly increments
> the hardware write pointer despite no descriptor being written.
> 
> Replace both gotos with early return, removing the unused xmit_end label.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: a36634e87e16 ("net/nfp: add flower ctrl VNIC Rx/Tx")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Denis Sergeev <denserg.edu@gmail.com>

Applied to next-net