patch 'net/bnxt/tf_ulp: check bounds for FW-supplied IDs' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 10/29/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/d5baa1e9c8d1ead198708e0eecdc7d62b77c6d7e

Thanks.

Luca Boccassi

---
>From d5baa1e9c8d1ead198708e0eecdc7d62b77c6d7e Mon Sep 17 00:00:00 2001
From: Joseph Wong <joseph.wong at broadcom.com>
Date: Mon, 21 Sep 2026 08:39:48 -0500
Subject: [PATCH] net/bnxt/tf_ulp: check bounds for FW-supplied IDs

[ upstream commit 0edc5614ee6c2e2d5edc17699ed75731396799b5 ]

In ulp_port_db_port_update(), firmware supplies IDs (drv_func_id,
vf_func_id, phy_port_id) which are used as array indices. Add
strict bounds checking to prevent out of bounds memory accesses.

Fixes: 45e8e1d406b7 ("net/bnxt: enhance port DB")

Signed-off-by: Joseph Wong <joseph.wong at broadcom.com>
Signed-off-by: Manish Kurup <manish.kurup at broadcom.com>
Signed-off-by: Mohammad Shuab Siddique <mohammad-shuab.siddique at broadcom.com>
---
 drivers/net/bnxt/tf_ulp/ulp_port_db.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/drivers/net/bnxt/tf_ulp/ulp_port_db.c b/drivers/net/bnxt/tf_ulp/ulp_port_db.c
index 69077717253..e41b9bf4b43 100644
--- a/drivers/net/bnxt/tf_ulp/ulp_port_db.c
+++ b/drivers/net/bnxt/tf_ulp/ulp_port_db.c
@@ -159,6 +159,11 @@ int32_t	ulp_port_db_port_update(struct bnxt_ulp_context *ulp_ctxt,
 	intf->drv_func_id = bnxt_pmd_get_fw_func_id(port_id,
 						BNXT_ULP_INTF_TYPE_INVALID);
 
+	if (intf->drv_func_id >= BNXT_PORT_DB_MAX_FUNC) {
+		BNXT_DRV_DBG(ERR, "Invalid drv_func_id %u", intf->drv_func_id);
+		return -EINVAL;
+	}
+
 	func = &port_db->ulp_func_id_tbl[intf->drv_func_id];
 	if (!func->func_valid) {
 		func->func_svif = bnxt_pmd_get_svif(port_id, true,
@@ -180,6 +185,11 @@ int32_t	ulp_port_db_port_update(struct bnxt_ulp_context *ulp_ctxt,
 		intf->vf_func_id =
 			bnxt_pmd_get_fw_func_id(port_id, BNXT_ULP_INTF_TYPE_VF_REP);
 
+		if (intf->vf_func_id >= BNXT_PORT_DB_MAX_FUNC) {
+			BNXT_DRV_DBG(ERR, "Invalid vf_func_id %u", intf->vf_func_id);
+			return -EINVAL;
+		}
+
 		func = &port_db->ulp_func_id_tbl[intf->vf_func_id];
 		func->func_svif =
 			bnxt_pmd_get_svif(port_id, true, BNXT_ULP_INTF_TYPE_VF_REP);
@@ -198,6 +208,11 @@ int32_t	ulp_port_db_port_update(struct bnxt_ulp_context *ulp_ctxt,
 			func->table_scope = tsid;
 	}
 
+	if (func->phy_port_id >= port_db->phy_port_cnt) {
+		BNXT_DRV_DBG(ERR, "Invalid phy_port_id %u", func->phy_port_id);
+		return -EINVAL;
+	}
+
 	/* When there is no match, the default action is to send the packet to
 	 * the kernel. And to send it to the kernel, we need the PF's vnic id.
 	 */
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-10-27 11:44:00.687214018 +0000
+++ 0182-net-bnxt-tf_ulp-check-bounds-for-FW-supplied-IDs.patch	2026-10-27 11:43:53.766067248 +0000
@@ -1 +1 @@
-From 0edc5614ee6c2e2d5edc17699ed75731396799b5 Mon Sep 17 00:00:00 2001
+From d5baa1e9c8d1ead198708e0eecdc7d62b77c6d7e Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 0edc5614ee6c2e2d5edc17699ed75731396799b5 ]
+
@@ -11 +12,0 @@
-Cc: stable at dpdk.org
@@ -21 +22 @@
-index 6907771725..e41b9bf4b4 100644
+index 69077717253..e41b9bf4b43 100644