[PATCH net 0/2] net/mlx5e: fix NULL derefs when RX queue mapping outlives channel reconfig

Hi all,

This series fixes two related NULL derefs in mlx5e's kTLS RX offload that
surface when a channel-count reduction (e.g. ethtool -L combined N) leaves
sockets carrying a queue index that is no longer valid

Patch 1: reject stale RX queue mapping on RX offload setup
Patch 2: guard RX resync against stale channel index

Not addressed in this series:

- Torn reads of `priv->channels` during the struct-copy publish in
  `mlx5e_switch_priv_channels()`. A reader on another CPU can still
  briefly observe `{new c, old num}`, so bounds-checking against a
  stale `num` can pass while dereferencing the new smaller array.
  Closing that window likely needs proper synchronization,
  such as RCU pointer, which is a larger change and better handled
  in a separate series.
    
- Re-homing existing offloaded sockets across a channel shrink so
  `priv_rx->rxq` remains valid. Patch 2 makes this failure mode graceful
  by preventing the dereference, but the offload remains functionally
  broken until the socket is torn down and re-added. That looks like a
  broader design question for the mlx5 maintainers.

Rishikesh Jethwani (2):
  net/mlx5e: kTLS: reject stale RX queue mapping on RX offload setup
  net/mlx5e: kTLS: guard RX resync against stale channel index

 .../mellanox/mlx5/core/en_accel/ktls_rx.c     | 24 ++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

-- 
2.25.1