Patch 1 sets msg->desc to NULL after kfree to avoid leaving a
dangling pointer in a struct that is reused across loop iterations.

Patch 2 adds the missing const qualifier to the reg parameter of
hclge_log_error(), which is never modified within the function.

Patch 3 uses the txqueue parameter passed by the ndo_tx_timeout
callback directly, instead of iterating all tx queues to find the
timed out one.

---
Changes in v2:
patch3:
    - Use h->kinfo.num_tqps for bounds check instead of
      ndev->num_tx_queues
    - Restore the netif_xmit_timeout_ms() check by making
      hns3_dump_timeout_queue() return bool and gating on
      its return value, so a cleared stall does not trigger
      a reset
    - Fold the bounds fix into this patch rather than tracking
      it as a separate bugfix, as the OOB has not been
      encountered in practice

v1: https://lore.kernel.org/all/20260804130933.880552-1-shaojijie@huawei.com/
---

Jian Shen (2):
  net: hns3: set msg->desc to NULL after kfree in hclge_query_reg_info()
  net: hns3: use txqueue parameter directly in ndo_tx_timeout

Jijie Shao (1):
  net: hns3: add missing const qualifier to hclge_log_error() reg
    parameter

 .../net/ethernet/hisilicon/hns3/hns3_enet.c   | 48 +++++++++----------
 .../hisilicon/hns3/hns3pf/hclge_err.c         |  3 +-
 2 files changed, 24 insertions(+), 27 deletions(-)


base-commit: 4fa4977a0d900f936bcae5cd2c510be5554e8dd6
-- 
2.33.0