patch 'net/bnxt/tf_ulp: fix bit allocator out-of-bounds read' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 11/07/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/b60a59adfa6657e60f068233a68abc1fb4978dd0

Thanks.

Luca Boccassi

---
>From b60a59adfa6657e60f068233a68abc1fb4978dd0 Mon Sep 17 00:00:00 2001
From: Joseph Wong <joseph.wong at broadcom.com>
Date: Mon, 5 Oct 2026 15:25:15 -0500
Subject: [PATCH] net/bnxt/tf_ulp: fix bit allocator out-of-bounds read

[ upstream commit 224682d49f12b28b49ae939e1987c250fc63fe37 ]

In ulp_bit_alloc_list_alloc(), the loop condition could allow the
index to reach bsize_64 before the bounds check ran (the do-while
body reads blist->bdata[idx++] before the loop condition tests
idx <= bsize_64), causing an out-of-bounds read one element past
the array. Refactor the loop to check the bound before indexing.

Fixes: 0001cc58d362 ("net/bnxt: support generic hash table")

Signed-off-by: Joseph Wong <joseph.wong at broadcom.com>
Signed-off-by: Manish Kurup <manish.kurup at broadcom.com>
---
 drivers/net/bnxt/tf_ulp/ulp_gen_hash.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/drivers/net/bnxt/tf_ulp/ulp_gen_hash.c b/drivers/net/bnxt/tf_ulp/ulp_gen_hash.c
index e8cb1a3784c..05525c48beb 100644
--- a/drivers/net/bnxt/tf_ulp/ulp_gen_hash.c
+++ b/drivers/net/bnxt/tf_ulp/ulp_gen_hash.c
@@ -21,16 +21,15 @@ int32_t ulp_bit_alloc_list_alloc(struct bit_alloc_list *blist,
 	uint32_t bsize_64 = blist->bsize / ULP_64B_IN_BYTES;
 
 	/* Iterate all numbers that have all 1's */
-	do {
-		bentry = blist->bdata[idx++];
-	} while (bentry == -1UL && idx <= bsize_64);
-
-	if (idx <= bsize_64) {
-		if (bentry)
+	while (idx < bsize_64) {
+		bentry = blist->bdata[idx];
+		if (bentry != -1UL) {
 			jdx = rte_clz64(~bentry);
-		*index = ((idx - 1) * ULP_INDEX_BITMAP_SIZE) + jdx;
-		ULP_INDEX_BITMAP_SET(blist->bdata[(idx - 1)], jdx);
-		return 0;
+			*index = (idx * ULP_INDEX_BITMAP_SIZE) + jdx;
+			ULP_INDEX_BITMAP_SET(blist->bdata[idx], jdx);
+			return 0;
+		}
+		idx++;
 	}
 	jdx = (uint32_t)(bsize_64 * ULP_INDEX_BITMAP_SIZE);
 	BNXT_DRV_DBG(ERR, "bit allocator is full reached max:%x\n", jdx);
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-11-05 16:42:46.367886887 +0000
+++ 0035-net-bnxt-tf_ulp-fix-bit-allocator-out-of-bounds-read.patch	2026-11-05 16:42:44.933061145 +0000
@@ -1 +1 @@
-From 224682d49f12b28b49ae939e1987c250fc63fe37 Mon Sep 17 00:00:00 2001
+From b60a59adfa6657e60f068233a68abc1fb4978dd0 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 224682d49f12b28b49ae939e1987c250fc63fe37 ]
+
@@ -13 +14,0 @@
-Cc: stable at dpdk.org
@@ -22 +23 @@
-index 74cdd5c1da..d94b59286f 100644
+index e8cb1a3784c..05525c48beb 100644
@@ -49 +50 @@
- 	BNXT_DRV_DBG(ERR, "bit allocator is full reached max:%d\n", jdx);
+ 	BNXT_DRV_DBG(ERR, "bit allocator is full reached max:%x\n", jdx);