patch 'net/bnxt: fix TPA agg Rx descriptor and VNIC query bounds' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 10/29/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/2b5e7c9556dbf27620f1c79e73f155369979931c

Thanks.

Luca Boccassi

---
>From 2b5e7c9556dbf27620f1c79e73f155369979931c Mon Sep 17 00:00:00 2001
From: Kishore Padmanabha <kishore.padmanabha at broadcom.com>
Date: Tue, 29 Sep 2026 12:04:08 -0600
Subject: [PATCH] net/bnxt: fix TPA agg Rx descriptor and VNIC query bounds

[ upstream commit cf4fc5219ac80d5762dfe599e3564b1addd6595f ]

Three independent out-of-bounds issues:

- bnxt_rx_pkt() incremented tpa_info->agg_count and indexed
  tpa_info->agg_arr[] with only an RTE_ASSERT (compiled out in release
  builds) guarding the array bound, allowing an out-of-bounds write if
  firmware sent more aggregation segments than TPA_MAX_NUM_SEGS.

- bnxt_rx_descriptor_status_op() used the firmware-supplied completion
  opaque value directly as an rx_buf_ring[] index without masking it to
  the ring size first.

- bnxt_hwrm_func_vf_vnic_query() returned the firmware-reported
  vnic_id_cnt unclamped; a value exceeding bp->pf->total_vnics would
  cause the caller to iterate past the end of its VNIC ID buffer.

Fixes: b150a7e7ee66 ("net/bnxt: support LRO on Thor adapters")
Fixes: 0fe613bb87b2 ("net/bnxt: support Rx descriptor status")
Fixes: cbcd375d37d2 ("net/bnxt: fix HWRM macros and locking")

Signed-off-by: Kishore Padmanabha <kishore.padmanabha at broadcom.com>
Signed-off-by: Mohammad Shuab Siddique <mohammad-shuab.siddique at broadcom.com>
---
 drivers/net/bnxt/bnxt_ethdev.c |  3 ++-
 drivers/net/bnxt/bnxt_hwrm.c   |  3 ++-
 drivers/net/bnxt/bnxt_rxr.c    | 10 +++++++++-
 3 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/drivers/net/bnxt/bnxt_ethdev.c b/drivers/net/bnxt/bnxt_ethdev.c
index 88be4322dda..9d40218089b 100644
--- a/drivers/net/bnxt/bnxt_ethdev.c
+++ b/drivers/net/bnxt/bnxt_ethdev.c
@@ -3551,7 +3551,8 @@ bnxt_rx_descriptor_status_op(void *rx_queue, uint16_t offset)
 		case CMPL_BASE_TYPE_RX_L2:
 		case CMPL_BASE_TYPE_RX_L2_V2:
 			if (desc == offset) {
-				cons = rxcmp->opaque;
+				cons = RING_IDX(rxr->rx_ring_struct,
+						 rxcmp->opaque);
 				if (rxr->rx_buf_ring[cons])
 					return RTE_ETH_RX_DESC_DONE;
 				else
diff --git a/drivers/net/bnxt/bnxt_hwrm.c b/drivers/net/bnxt/bnxt_hwrm.c
index 96d114babd6..0c026faeae0 100644
--- a/drivers/net/bnxt/bnxt_hwrm.c
+++ b/drivers/net/bnxt/bnxt_hwrm.c
@@ -6217,7 +6217,8 @@ static int bnxt_hwrm_func_vf_vnic_query(struct bnxt *bp, uint16_t vf,
 	}
 	rc = bnxt_hwrm_send_message(bp, &req, sizeof(req), BNXT_USE_CHIMP_MB);
 	HWRM_CHECK_RESULT();
-	rc = rte_le_to_cpu_32(resp->vnic_id_cnt);
+	rc = RTE_MIN(rte_le_to_cpu_32(resp->vnic_id_cnt),
+		     (uint32_t)bp->pf->total_vnics);
 
 	HWRM_UNLOCK();
 
diff --git a/drivers/net/bnxt/bnxt_rxr.c b/drivers/net/bnxt/bnxt_rxr.c
index a40d1f33301..e5681d39243 100644
--- a/drivers/net/bnxt/bnxt_rxr.c
+++ b/drivers/net/bnxt/bnxt_rxr.c
@@ -1166,7 +1166,15 @@ static int bnxt_rx_pkt(struct rte_mbuf **rx_pkt,
 		}
 
 		tpa_info = &rxr->tpa_info[agg_id];
-		RTE_ASSERT(tpa_info->agg_count < 16);
+		if (unlikely(tpa_info->agg_count >= TPA_MAX_NUM_SEGS)) {
+			PMD_DRV_LOG_LINE(ERR,
+					 "TPA abuf: agg_count %u exceeds max %u",
+					 tpa_info->agg_count, TPA_MAX_NUM_SEGS);
+			tpa_info->agg_count = 0;
+			bnxt_sched_ring_reset(rxq);
+			rc = -EINVAL;
+			goto next_rx;
+		}
 		tpa_info->agg_arr[tpa_info->agg_count++] = *rx_agg;
 		rc = -EINVAL; /* Continue w/o new mbuf */
 		goto next_rx;
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-10-27 11:43:59.866637883 +0000
+++ 0160-net-bnxt-fix-TPA-agg-Rx-descriptor-and-VNIC-query-bo.patch	2026-10-27 11:43:53.722065886 +0000
@@ -1 +1 @@
-From cf4fc5219ac80d5762dfe599e3564b1addd6595f Mon Sep 17 00:00:00 2001
+From 2b5e7c9556dbf27620f1c79e73f155369979931c Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit cf4fc5219ac80d5762dfe599e3564b1addd6595f ]
+
@@ -24 +25,0 @@
-Cc: stable at dpdk.org
@@ -35 +36 @@
-index 20084826d3..3a530c31aa 100644
+index 88be4322dda..9d40218089b 100644
@@ -38 +39 @@
-@@ -3624,7 +3624,8 @@ bnxt_rx_descriptor_status_op(void *rx_queue, uint16_t offset)
+@@ -3551,7 +3551,8 @@ bnxt_rx_descriptor_status_op(void *rx_queue, uint16_t offset)
@@ -49 +50 @@
-index 361402b36f..42ed6e5ae1 100644
+index 96d114babd6..0c026faeae0 100644
@@ -52 +53 @@
-@@ -6234,7 +6234,8 @@ static int bnxt_hwrm_func_vf_vnic_query(struct bnxt *bp, uint16_t vf,
+@@ -6217,7 +6217,8 @@ static int bnxt_hwrm_func_vf_vnic_query(struct bnxt *bp, uint16_t vf,
@@ -63 +64 @@
-index 1790ce839f..fa10446c27 100644
+index a40d1f33301..e5681d39243 100644
@@ -66 +67 @@
-@@ -1156,7 +1156,15 @@ static int bnxt_rx_pkt(struct rte_mbuf **rx_pkt,
+@@ -1166,7 +1166,15 @@ static int bnxt_rx_pkt(struct rte_mbuf **rx_pkt,