patch 'net/bnxt: check RSS queues and context init offset' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 10/29/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/5774e4d98e6e0b3b083e71ca7f1176a1868f590e

Thanks.

Luca Boccassi

---
>From 5774e4d98e6e0b3b083e71ca7f1176a1868f590e Mon Sep 17 00:00:00 2001
From: Kishore Padmanabha <kishore.padmanabha at broadcom.com>
Date: Wed, 9 Sep 2026 10:45:37 -0600
Subject: [PATCH] net/bnxt: check RSS queues and context init offset

[ upstream commit bab951eb89d4657710ba022b41b1f699fc9de282 ]

Two independent out-of-bounds issues:

- match_vnic_rss_cfg() indexed bp->rx_queues[] with firmware/
  application-supplied RSS queue IDs without validating them against
  bp->rx_nr_rings first, and dereferenced the resulting (possibly
  NULL) queue pointer unconditionally.

- bnxt_init_ctx_initializer() computed ctxm->init_offset from a
  firmware-supplied byte offset without checking it against the
  context entry's own size, allowing an out-of-range init offset to
  be used later when initializing backing-store entries.

Fixes: adc0f81c6552 ("net/bnxt: support RSS action")
Fixes: fe2f715ca580 ("net/bnxt: support backing store v2")

Signed-off-by: Kishore Padmanabha <kishore.padmanabha at broadcom.com>
Signed-off-by: Mohammad Shuab Siddique <mohammad-shuab.siddique at broadcom.com>
---
 drivers/net/bnxt/bnxt_flow.c | 13 +++++++++++++
 drivers/net/bnxt/bnxt_hwrm.c | 14 +++++++++++---
 2 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/drivers/net/bnxt/bnxt_flow.c b/drivers/net/bnxt/bnxt_flow.c
index bffa8efc012..34a3a1875b2 100644
--- a/drivers/net/bnxt/bnxt_flow.c
+++ b/drivers/net/bnxt/bnxt_flow.c
@@ -968,10 +968,23 @@ static int match_vnic_rss_cfg(struct bnxt *bp,
 {
 	unsigned int match = 0, i;
 
+	if (rss->queue_num > bp->rx_nr_rings)
+		return -EINVAL;
+
 	if (vnic->rx_queue_cnt != rss->queue_num)
 		return -EINVAL;
 
 	for (i = 0; i < rss->queue_num; i++) {
+		if (rss->queue[i] >= bp->rx_nr_rings) {
+			PMD_DRV_LOG_LINE(ERR, "Queue ID %u for RSS exceeds ring count %u",
+					 rss->queue[i], bp->rx_nr_rings);
+			return -EINVAL;
+		}
+		if (!bp->rx_queues[rss->queue[i]]) {
+			PMD_DRV_LOG_LINE(ERR, "Queue ID %u for RSS is not configured",
+					 rss->queue[i]);
+			return -EINVAL;
+		}
 		if (!bp->rx_queues[rss->queue[i]]->vnic->rx_queue_cnt &&
 		    !bp->rx_queues[rss->queue[i]]->rx_started)
 			return -EINVAL;
diff --git a/drivers/net/bnxt/bnxt_hwrm.c b/drivers/net/bnxt/bnxt_hwrm.c
index 2cd7582be00..6519f7fad8e 100644
--- a/drivers/net/bnxt/bnxt_hwrm.c
+++ b/drivers/net/bnxt/bnxt_hwrm.c
@@ -6753,10 +6753,18 @@ static void bnxt_init_ctx_initializer(struct bnxt_ctx_mem *ctxm,
 {
 	ctxm->init_value = init_val;
 	ctxm->init_offset = BNXT_CTX_INIT_INVALID_OFFSET;
-	if (init_mask_set)
-		ctxm->init_offset = init_offset * 4;
-	else
+	if (init_mask_set) {
+		ctxm->init_offset = (uint16_t)(init_offset * 4);
+		if (ctxm->init_offset >= ctxm->entry_size) {
+			PMD_DRV_LOG_LINE(WARNING,
+					 "ctx type 0x%x: init_offset %u >= entry_size %u, disabling init",
+					 ctxm->type, ctxm->init_offset, ctxm->entry_size);
+			ctxm->init_value = 0;
+			ctxm->init_offset = BNXT_CTX_INIT_INVALID_OFFSET;
+		}
+	} else {
 		ctxm->init_value = 0;
+	}
 }
 
 static int bnxt_alloc_all_ctx_pg_info(struct bnxt *bp)
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-10-27 11:44:00.204857590 +0000
+++ 0169-net-bnxt-check-RSS-queues-and-context-init-offset.patch	2026-10-27 11:43:53.754066877 +0000
@@ -1 +1 @@
-From bab951eb89d4657710ba022b41b1f699fc9de282 Mon Sep 17 00:00:00 2001
+From 5774e4d98e6e0b3b083e71ca7f1176a1868f590e Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit bab951eb89d4657710ba022b41b1f699fc9de282 ]
+
@@ -20 +21,0 @@
-Cc: stable at dpdk.org
@@ -30 +31 @@
-index c500890ce7..66c2a9bbc1 100644
+index bffa8efc012..34a3a1875b2 100644
@@ -33 +34 @@
-@@ -962,10 +962,23 @@ static int match_vnic_rss_cfg(struct bnxt *bp,
+@@ -968,10 +968,23 @@ static int match_vnic_rss_cfg(struct bnxt *bp,
@@ -58 +59 @@
-index df8cd14efb..ab1521953a 100644
+index 2cd7582be00..6519f7fad8e 100644