patch 'net/bnxt: validate TPA aggregation ID from completions' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 10/29/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/15d854fe388605df23331dd2c320758d51dbc441

Thanks.

Luca Boccassi

---
>From 15d854fe388605df23331dd2c320758d51dbc441 Mon Sep 17 00:00:00 2001
From: Mohammad Shuab Siddique <mohammad-shuab.siddique at broadcom.com>
Date: Tue, 29 Sep 2026 12:03:25 -0600
Subject: [PATCH] net/bnxt: validate TPA aggregation ID from completions

[ upstream commit f00dd9a7ccb8abf157b10ee3e19460b9cf655151 ]

TPA start/end and TPA v2 abuf paths indexed rxr->tpa_info[] using
the aggregation ID from the completion without checking
BNXT_TPA_MAX_AGGS. Add bounds checks and schedule a ring reset on
failure. Also fix abuf aggregation ID decode to use
rte_le_to_cpu_16() when reading the device field. On the legacy
(non-Thor) TPA end path, also discard the pending agg bufs before
returning on an invalid agg_id, matching the existing in_reset early
return a few lines above; otherwise those agg buf completions are
left unconsumed and the CQ raw_cons goes out of sync with the ring
even after the scheduled reset.

Fixes: 0958d8b6435d ("net/bnxt: support LRO")
Fixes: b150a7e7ee66 ("net/bnxt: support LRO on Thor adapters")

Signed-off-by: Mohammad Shuab Siddique <mohammad-shuab.siddique at broadcom.com>
---
 drivers/net/bnxt/bnxt_rxr.c | 50 ++++++++++++++++++++++++++++---------
 1 file changed, 38 insertions(+), 12 deletions(-)

diff --git a/drivers/net/bnxt/bnxt_rxr.c b/drivers/net/bnxt/bnxt_rxr.c
index b15b79db5e6..a40d1f33301 100644
--- a/drivers/net/bnxt/bnxt_rxr.c
+++ b/drivers/net/bnxt/bnxt_rxr.c
@@ -236,12 +236,19 @@ static void bnxt_tpa_start(struct bnxt_rx_queue *rxq,
 			   struct rx_tpa_start_cmpl_hi *tpa_start1)
 {
 	struct bnxt_rx_ring_info *rxr = rxq->rx_ring;
-	uint16_t agg_id;
-	uint16_t data_cons;
 	struct bnxt_tpa_info *tpa_info;
+	uint32_t data_cons, agg_id;
+	struct bnxt *bp = rxq->bp;
 	struct rte_mbuf *mbuf;
 
-	agg_id = bnxt_tpa_start_agg_id(rxq->bp, tpa_start);
+	agg_id = bnxt_tpa_start_agg_id(bp, tpa_start);
+	if (unlikely(agg_id >= BNXT_TPA_MAX_AGGS(bp))) {
+		PMD_DRV_LOG_LINE(ERR,
+				 "TPA start: invalid agg_id %u (max %u)",
+				 agg_id, BNXT_TPA_MAX_AGGS(bp));
+		bnxt_sched_ring_reset(rxq);
+		return;
+	}
 
 	data_cons = tpa_start->opaque;
 	tpa_info = &rxr->tpa_info[agg_id];
@@ -268,7 +275,7 @@ static void bnxt_tpa_start(struct bnxt_rx_queue *rxq,
 	mbuf->port = rxq->port_id;
 	mbuf->ol_flags = RTE_MBUF_F_RX_LRO;
 
-	bnxt_tpa_get_metadata(rxq->bp, tpa_info, tpa_start, tpa_start1);
+	bnxt_tpa_get_metadata(bp, tpa_info, tpa_start, tpa_start1);
 
 	if (likely(tpa_info->hash_valid)) {
 		mbuf->hash.rss = tpa_info->rss_hash;
@@ -278,7 +285,7 @@ static void bnxt_tpa_start(struct bnxt_rx_queue *rxq,
 		mbuf->ol_flags |= RTE_MBUF_F_RX_FDIR | RTE_MBUF_F_RX_FDIR_ID;
 	}
 
-	if (tpa_info->vlan_valid && BNXT_RX_VLAN_STRIP_EN(rxq->bp)) {
+	if (tpa_info->vlan_valid && BNXT_RX_VLAN_STRIP_EN(bp)) {
 		mbuf->vlan_tci = tpa_info->vlan;
 		mbuf->ol_flags |= RTE_MBUF_F_RX_VLAN | RTE_MBUF_F_RX_VLAN_STRIPPED;
 	}
@@ -421,20 +428,21 @@ static inline struct rte_mbuf *bnxt_tpa_end(
 {
 	struct bnxt_cp_ring_info *cpr = rxq->cp_ring;
 	struct bnxt_rx_ring_info *rxr = rxq->rx_ring;
-	uint16_t agg_id;
-	struct rte_mbuf *mbuf;
-	uint8_t agg_bufs;
+	struct bnxt_tpa_info *tpa_info;
+	struct bnxt *bp = rxq->bp;
 	uint8_t payload_offset;
-	struct bnxt_tpa_info *tpa_info;
+	struct rte_mbuf *mbuf;
+	uint8_t agg_bufs;
+	uint32_t agg_id;
 
 	if (unlikely(rxq->in_reset)) {
 		PMD_DRV_LOG_LINE(ERR, "rxq->in_reset: raw_cp_cons:%d",
 			    *raw_cp_cons);
-		bnxt_discard_rx(rxq->bp, cpr, raw_cp_cons, tpa_end);
+		bnxt_discard_rx(bp, cpr, raw_cp_cons, tpa_end);
 		return NULL;
 	}
 
-	if (BNXT_CHIP_P5_P7(rxq->bp)) {
+	if (BNXT_CHIP_P5_P7(bp)) {
 		struct rx_tpa_v2_end_cmpl *th_tpa_end;
 		struct rx_tpa_v2_end_cmpl_hi *th_tpa_end1;
 
@@ -451,6 +459,15 @@ static inline struct rte_mbuf *bnxt_tpa_end(
 		payload_offset = tpa_end->payload_offset;
 	}
 
+	if (unlikely(agg_id >= BNXT_TPA_MAX_AGGS(bp))) {
+		PMD_DRV_LOG_LINE(ERR,
+				 "TPA end: invalid agg_id %u (max %u)",
+				 agg_id, BNXT_TPA_MAX_AGGS(bp));
+		bnxt_discard_rx(bp, cpr, raw_cp_cons, tpa_end);
+		bnxt_sched_ring_reset(rxq);
+		return NULL;
+	}
+
 	tpa_info = &rxr->tpa_info[agg_id];
 	mbuf = tpa_info->mbuf;
 	RTE_ASSERT(mbuf != NULL);
@@ -1136,9 +1153,18 @@ static int bnxt_rx_pkt(struct rte_mbuf **rx_pkt,
 
 	if (cmp_type == RX_TPA_V2_ABUF_CMPL_TYPE_RX_TPA_AGG) {
 		struct rx_tpa_v2_abuf_cmpl *rx_agg = (void *)rxcmp;
-		uint16_t agg_id = rte_cpu_to_le_16(rx_agg->agg_id);
+		uint32_t agg_id = rte_le_to_cpu_16(rx_agg->agg_id);
 		struct bnxt_tpa_info *tpa_info;
 
+		if (unlikely(agg_id >= BNXT_TPA_MAX_AGGS(bp))) {
+			PMD_DRV_LOG_LINE(ERR,
+					 "TPA abuf: invalid agg_id %u (max %u)",
+					 agg_id, BNXT_TPA_MAX_AGGS(bp));
+			bnxt_sched_ring_reset(rxq);
+			rc = -EINVAL;
+			goto next_rx;
+		}
+
 		tpa_info = &rxr->tpa_info[agg_id];
 		RTE_ASSERT(tpa_info->agg_count < 16);
 		tpa_info->agg_arr[tpa_info->agg_count++] = *rx_agg;
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-10-27 11:43:59.749322058 +0000
+++ 0157-net-bnxt-validate-TPA-aggregation-ID-from-completion.patch	2026-10-27 11:43:53.710065516 +0000
@@ -1 +1 @@
-From f00dd9a7ccb8abf157b10ee3e19460b9cf655151 Mon Sep 17 00:00:00 2001
+From 15d854fe388605df23331dd2c320758d51dbc441 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit f00dd9a7ccb8abf157b10ee3e19460b9cf655151 ]
+
@@ -19 +20,0 @@
-Cc: stable at dpdk.org
@@ -27 +28 @@
-index 98bdbc136a..1790ce839f 100644
+index b15b79db5e6..a40d1f33301 100644
@@ -30 +31 @@
-@@ -227,12 +227,19 @@ static void bnxt_tpa_start(struct bnxt_rx_queue *rxq,
+@@ -236,12 +236,19 @@ static void bnxt_tpa_start(struct bnxt_rx_queue *rxq,
@@ -53 +54 @@
-@@ -259,7 +266,7 @@ static void bnxt_tpa_start(struct bnxt_rx_queue *rxq,
+@@ -268,7 +275,7 @@ static void bnxt_tpa_start(struct bnxt_rx_queue *rxq,
@@ -62 +63 @@
-@@ -269,7 +276,7 @@ static void bnxt_tpa_start(struct bnxt_rx_queue *rxq,
+@@ -278,7 +285,7 @@ static void bnxt_tpa_start(struct bnxt_rx_queue *rxq,
@@ -71 +72 @@
-@@ -412,20 +419,21 @@ static inline struct rte_mbuf *bnxt_tpa_end(
+@@ -421,20 +428,21 @@ static inline struct rte_mbuf *bnxt_tpa_end(
@@ -99 +100 @@
-@@ -442,6 +450,15 @@ static inline struct rte_mbuf *bnxt_tpa_end(
+@@ -451,6 +459,15 @@ static inline struct rte_mbuf *bnxt_tpa_end(
@@ -115 +116 @@
-@@ -1126,9 +1143,18 @@ static int bnxt_rx_pkt(struct rte_mbuf **rx_pkt,
+@@ -1136,9 +1153,18 @@ static int bnxt_rx_pkt(struct rte_mbuf **rx_pkt,