On Sun, 20 Sep 2026 20:18:17 -0600 Mohammad Shuab Siddique <[email protected]> wrote:
> From: Mohammad Shuab Siddique <[email protected]> > > When creating a flow that requires a destination queue but none is > specified in the flow create command, find_matching_vnic() returns > NULL and the code falls through to insert the new filter into > vnic->filter, dereferencing the NULL vnic and causing a segfault. > > Check for a NULL vnic and reject the flow create with a clear error > instead of crashing. > > Fixes: 59119d49529e ("net/bnxt: fix flow create when RSS is disabled") > Cc: [email protected] > > Signed-off-by: Dakota Sicher <[email protected]> > Signed-off-by: Mohammad Shuab Siddique <[email protected]> > --- Better AI review flagged an error here: [PATCH v2] net/bnxt: fix flow create segfault Error: new vnic == NULL branch corrupts filter lists when update_flow is set. When bnxt_match_filter() returns -EXDEV it has already done STAILQ_INSERT_TAIL(&vnic->filter, nf, next) on the existing vnic and set flow->filter = nf for the existing flow. If find_matching_vnic() then returns NULL, the new branch calls bnxt_clear_one_vnic_filter() and bnxt_free_filter() on that same nf. bnxt_free_filter() memsets it and links it onto bp->free_filter_list while it is still on vnic->filter. The existing flow is left pointing at a recycled filter whose HW filter was just deleted. Before this patch the update_flow path went to free_flow without touching vnic. Gate the new check on !update_flow, or handle update_flow first.
