Re: [PATCH net] bnxt_en: Bound SW TPA IDs to prevent crashes

On Fri, Aug 21, 2026 at 4:35 PM Joe Damato <[email protected]> wrote:
> diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
> index d3cb25abb632..f348fb93047d 100644
> --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
> +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
> @@ -1517,14 +1517,15 @@ static int bnxt_discard_rx(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
>         return 0;
>  }
>
> -static u16 bnxt_alloc_agg_idx(struct bnxt_rx_ring_info *rxr, u16 agg_id)
> +static u16 bnxt_alloc_agg_idx(struct bnxt *bp, struct bnxt_rx_ring_info *rxr,
> +                             u16 agg_id)
>  {
>         struct bnxt_tpa_idx_map *map = rxr->rx_tpa_idx_map;
>         u16 idx = agg_id & MAX_TPA_P5_MASK;

Thanks for the patch.  For slightly more efficient code here, we can
allocate the tpa array size to be bp->max_tpa rounded up to the next
power of 2.  Let's say bp->max_tpa_roundup_size.  Here, we can just
mask agg_id:

idx = agg_id & (bp->max_tpa_roundup_size - 1);

>
> -       if (test_bit(idx, map->agg_idx_bmap)) {
> -               idx = find_first_zero_bit(map->agg_idx_bmap, MAX_TPA_P5);
> -               if (idx >= MAX_TPA_P5)
> +       if (idx >= bp->max_tpa || test_bit(idx, map->agg_idx_bmap)) {
> +               idx = find_first_zero_bit(map->agg_idx_bmap, bp->max_tpa);
> +               if (idx >= bp->max_tpa)
>                         return INVALID_HW_RING_ID;
>         }
>         __set_bit(idx, map->agg_idx_bmap);