Re: [PATCH net v3] bnxt_en: validate firmware backing store types

[Michael Chan]

On Thu, Mar 26, 2026 at 7:21 AM Pengpeng Hou <pengpeng@xxxxxxxxxxx> wrote:

> @@ -8708,12 +8709,21 @@ static int bnxt_hwrm_func_backing_store_qcaps_v2(struct bnxt *bp)
>                 entry_size = le16_to_cpu(resp->entry_size);
>                 max_entries = le32_to_cpu(resp->max_num_entries);
>                 if (ctxm->mem_valid) {
> -                       if (!(flags & BNXT_CTX_MEM_PERSIST) ||
> -                           ctxm->entry_size != entry_size ||
> -                           ctxm->max_entries != max_entries)
> -                               bnxt_free_one_ctx_mem(bp, ctxm, true);
> -                       else
> +                       if ((flags & BNXT_CTX_MEM_PERSIST) &&
> +                           ctxm->entry_size == entry_size &&
> +                           ctxm->max_entries == max_entries) {
> +                               type = next_type;
>                                 continue;
> +                       }
> +
> +                       bnxt_free_one_ctx_mem(bp, ctxm, true);
> +               }
> +               if (le16_to_cpu(resp->type) >= BNXT_CTX_V2_MAX) {

The type in the FW response (resp->type) is defined to be the type in
the FW input message (req->type).  If you want to validate it, it
should be equal to the loop variable type or req->type.  Thanks.

> +                       netdev_warn(bp->dev,
> +                                   "invalid backing store type %u returned by firmware\n",
> +                                   le16_to_cpu(resp->type));
> +                       rc = -EINVAL;
> +                       goto ctx_done;

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature