[PATCH] net: bnxt: size agg_id_tbl for the full 12-bit agg_id

[Noah Weinberger]

Hello,

On P5-generation devices the TPA aggregation ID is a 12-bit field
(masks RX_TPA_START_CMP_AGG_ID_P5 / RX_TPA_END_CMP_AGG_ID_P5 /
RX_AGG_CMP_AGG_ID, all 0x0fff), but the per-ring mapping table is
sized for 10 bits:

    u16 agg_id_tbl[1024];

    static u16 bnxt_alloc_agg_idx(..., u16 agg_id)
    {
        u16 idx = agg_id & (bp->max_tpa_roundup_size - 1);
        ...
        __set_bit(idx, map->agg_idx_bmap);
        map->agg_id_tbl[agg_id] = idx;   /* unmasked agg_id */

    static u16 bnxt_lookup_agg_idx(struct bnxt_rx_ring_info *rxr, u16 agg_id)
    {
        return map->agg_id_tbl[agg_id]; /* unmasked agg_id */

Any agg_id >= 1024 writes a u16 out of bounds (into the trailing
agg_idx_bmap and the adjacent heap) and the lookup reads an
out-of-bounds u16 whose value is then used as the index into
rxr->rx_tpa[]. Pre-P5 parts use a 7-bit field and cannot reach it.

The patch sizes the table for the full 12-bit range. The map is
allocated with kzalloc(sizeof(*rxr->rx_tpa_idx_map)), so the
allocation scales automatically (~8 KB per RX ring).

Affected version/commit: mainline 8a65162514fbad21a2c58ffed65f42b27e92b163 (v7.4-rc2 window, 2026-11-08), drivers/net/ethernet/broadcom/bnxt/bnxt.h:436-437 and :560-561 and :398-399 (P5 AGG_ID masks are 12 bits: 0x0fff), :1101-1102 (u16 agg_id_tbl[1024]; DECLARE_BITMAP(agg_idx_bmap, MAX_TPA_P5)), bnxt.c:1555-1569 (bnxt_alloc_agg_idx: idx = agg_id & (max_tpa_roundup_size - 1) but map->agg_id_tbl[agg_id] = idx with the UNMASKED agg_id), :1579-1584 (bnxt_lookup_agg_idx: map->agg_id_tbl[agg_id]), :1628-1629 and :1951-1952 and :2082 (callers pass TPA_START_AGG_ID_P5 / TPA_END_AGG_ID_P5 / RX_AGG_CMP_AGG_ID, all 12-bit on P5)
The agg_id_tbl mechanism predates the reviewed window (P5-era code). No clamp was added since.

This was found during an assisted (AI-supported) static source review of
mainline 8a65162514fbad21a2c58ffed65f42b27e92b163 (v7.4-rc2 window, 2026-11-08). The patch below has NOT been compiled and has
NOT been runtime tested, and no reproducer was produced - the triggering
conditions are described above instead. Please treat this as a report for
verification rather than a battle-tested fix.

---
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
index 41d05efd63..ab6b2530ab 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
@@ -1098,7 +1098,7 @@ struct bnxt_tpa_info {
 };
 
 struct bnxt_tpa_idx_map {
-	u16		agg_id_tbl[1024];
+	u16		agg_id_tbl[4096];
 	DECLARE_BITMAP(agg_idx_bmap, MAX_TPA_P5);
 };