[PATCH v2] net/bnxt: fix flow create segfault

[Mohammad Shuab Siddique <mohammad-shuab.siddique@broadcom.com>]

From: Mohammad Shuab Siddique <mohammad-shuab.siddique@broadcom.com>

When creating a flow that requires a destination queue but none is
specified in the flow create command, find_matching_vnic() returns
NULL and the code falls through to insert the new filter into
vnic->filter, dereferencing the NULL vnic and causing a segfault.

Check for a NULL vnic and reject the flow create with a clear error
instead of crashing.

Fixes: 59119d49529e ("net/bnxt: fix flow create when RSS is disabled")
Cc: stable@dpdk.org

Signed-off-by: Dakota Sicher <dakota.sicher@broadcom.com>
Signed-off-by: Mohammad Shuab Siddique <mohammad-shuab.siddique@broadcom.com>
---
v2:
* Changed the new NULL check from "if (!vnic)" to "if (vnic == NULL)"
  to match this file's established convention for pointer NULL checks
  (e.g. the existing "if (vnic == NULL)" a few hundred lines above).
* Kept RTE_FLOW_ERROR_TYPE_HANDLE rather than RTE_FLOW_ERROR_TYPE_ACTION
  as one reviewer suggested: every other rte_flow_error_set() call in
  this same function (bnxt_flow_create()) uses
  RTE_FLOW_ERROR_TYPE_HANDLE regardless of the underlying cause, so
  switching just this one would be inconsistent with its neighbors.
* Real bug found during v2 review: the new branch didn't reset "ret"
  before "goto free_filter". If bnxt_match_filter() had already set
  update_flow (ret == -EXDEV) and the filter is a plain L2 filter, the
  stale -EXDEV survived to the free_flow label and reported the
  misleading "pattern exists, updating destination queue" success-like
  error instead of the real failure. Now sets ret = -EINVAL on this
  path, same as every other error branch in this function.

 drivers/net/bnxt/bnxt_flow.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/bnxt/bnxt_flow.c b/drivers/net/bnxt/bnxt_flow.c
index a2e590540b..0a2899fbbd 100644
--- a/drivers/net/bnxt/bnxt_flow.c
+++ b/drivers/net/bnxt/bnxt_flow.c
@@ -2148,6 +2148,14 @@ bnxt_flow_create(struct rte_eth_dev *dev,
 	}

 	vnic = find_matching_vnic(bp, filter);
+	if (vnic == NULL) {
+		rte_flow_error_set(error, EINVAL,
+				   RTE_FLOW_ERROR_TYPE_HANDLE, NULL,
+				   "Missing destination action for flow.");
+		bnxt_clear_one_vnic_filter(bp, filter);
+		ret = -EINVAL;
+		goto free_filter;
+	}
 done:
 	if (!ret || update_flow) {
 		flow->filter = filter;
-- 
2.47.3