Re: [PATCH net] bnxt_en: Bound SW TPA IDs to prevent crashes
From: Michael Chan <michael.chan@broadcom.com>
Date: 2026-08-24 08:34:06
Also in:
lkml, llvm, stable
On Fri, Aug 21, 2026 at 4:35 PM Joe Damato [off-list ref] wrote:
quoted hunk ↗ jump to hunk
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c index d3cb25abb632..f348fb93047d 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c@@ -1517,14 +1517,15 @@ static int bnxt_discard_rx(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, return 0; } -static u16 bnxt_alloc_agg_idx(struct bnxt_rx_ring_info *rxr, u16 agg_id) +static u16 bnxt_alloc_agg_idx(struct bnxt *bp, struct bnxt_rx_ring_info *rxr, + u16 agg_id) { struct bnxt_tpa_idx_map *map = rxr->rx_tpa_idx_map; u16 idx = agg_id & MAX_TPA_P5_MASK;
Thanks for the patch. For slightly more efficient code here, we can allocate the tpa array size to be bp->max_tpa rounded up to the next power of 2. Let's say bp->max_tpa_roundup_size. Here, we can just mask agg_id: idx = agg_id & (bp->max_tpa_roundup_size - 1);
- if (test_bit(idx, map->agg_idx_bmap)) {
- idx = find_first_zero_bit(map->agg_idx_bmap, MAX_TPA_P5);
- if (idx >= MAX_TPA_P5)
+ if (idx >= bp->max_tpa || test_bit(idx, map->agg_idx_bmap)) {
+ idx = find_first_zero_bit(map->agg_idx_bmap, bp->max_tpa);
+ if (idx >= bp->max_tpa)
return INVALID_HW_RING_ID;
}
__set_bit(idx, map->agg_idx_bmap);Attachments
- smime.p7s [application/pkcs7-signature] 5469 bytes