Re: [PATCH] net: bnxt: size agg_id_tbl for the full 12-bit agg_id

[Pavan Chebbi]

On Mon, Nov 9, 2026 at 5:23 AM Noah Weinberger
<NoahWeinberger2003@xxxxxxxxx> wrote:
>
> Hello,
>
> On P5-generation devices the TPA aggregation ID is a 12-bit field
> (masks RX_TPA_START_CMP_AGG_ID_P5 / RX_TPA_END_CMP_AGG_ID_P5 /
> RX_AGG_CMP_AGG_ID, all 0x0fff), but the per-ring mapping table is
> sized for 10 bits:
>
>     u16 agg_id_tbl[1024];
>
>     static u16 bnxt_alloc_agg_idx(..., u16 agg_id)
>     {
>         u16 idx = agg_id & (bp->max_tpa_roundup_size - 1);
>         ...
>         __set_bit(idx, map->agg_idx_bmap);
>         map->agg_id_tbl[agg_id] = idx;   /* unmasked agg_id */
>
>     static u16 bnxt_lookup_agg_idx(struct bnxt_rx_ring_info *rxr, u16 agg_id)
>     {
>         return map->agg_id_tbl[agg_id]; /* unmasked agg_id */
>
> Any agg_id >= 1024 writes a u16 out of bounds (into the trailing
> agg_idx_bmap and the adjacent heap) and the lookup reads an
> out-of-bounds u16 whose value is then used as the index into
> rxr->rx_tpa[]. Pre-P5 parts use a 7-bit field and cannot reach it.
>

This fix is not necessary because the patch assumes the agg_id can use
every value its 12-bit field can hold, but the HW never issues IDs
beyond 1023.

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature