From nobody Mon Aug 31 16:18:18 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hYZ0v5x3dz6r1Sb for ; Mon, 31 Aug 2026 16:18:23 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hYZ0v5PGPz421l for ; Mon, 31 Aug 2026 16:18:23 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788193103; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=2fQzhCK5mRYv1nZ9DF8QB6OUwPYgpmTvM9BgfhJz+mY=; b=nlVEkRygw/mGFafosnzP0iRQ2QleBYGscdZ4jcpomU3BZFBn+CIeukmNQ9qn5W6xSWcPAQ GyfeaCDHHQHWOtCytbzjBILt4Bjwo28ZcB0+ryzEZqrOLnVz65i+152iQfhl2dYHa3RYQH +kB3aygXSHdRuBGFtzA7yatHr7ujb8ohFiK35T8QgR8tKeVQnqZLF23UzKiryy1L1wZck1 HX/9SnucnovZv+09qYywLCo6JR58p0l7+G21oGYCpkHFQ+3nA8FoGITcS2vaaNWomr5HUm i1sC1qufMt8l1RvAJ5haA43Dkj02BAhmzBentNy+AE//izBx47x3oJgWt2Stcg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1788193103; a=rsa-sha256; cv=none; b=QNXdc3oDneSa5VIH2tPOqW1WQOSF5vpiPD1qQbAslGho6L3iqNb28j2UOMz7QpRUEz+myb qinDv1nLGXDgChCtUQpXNPNP24mD4s/Rs2EF8YZXhDbaRCX4HZF0N03ouLQY/S9P/tyNWb y3+bDgpva7YZMpZytPoZUobdh8dqXjMKQ/Ju7TID3eSOTRwNBGIRhBK9zLj/EimnUDWjQo qvlPn1f0ikJ02gnVMpdiqTr+avQ7CdKJd+q2bbOiL8hCHsPamOxWppqmAG5cEcma15F+vc Akh8CadmeS1UReIkUBWYVvoumzaJ0aZEulTXfdJWovWHpLTKjOFmumG961JS7g== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788193103; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=2fQzhCK5mRYv1nZ9DF8QB6OUwPYgpmTvM9BgfhJz+mY=; b=LS69c/CdJK3UZgbc9GHOtp6DB1IvOFd1wMIb77GZLFAxslpzbjtFV+fjqYz293x0NKNCqU Jd0ZcfeumDggXJOQOVztPMW3hhU3umykNh+g4vgSLCFA6Zl2Vx8YGDWyeTyy21+dVZcp0T 2VDqtaQU7fZPqNmfNbdJ91ZCJ7LFympamIy3QLzKNvdZp84FE8dk1ZNCrfLd6CTxQ2m9qt W0JGmMns1CZGUivregCpNxDi2m84NJXYCjjvqbTkBjb+CUtpg3CG5qlYLLLfhBAutFQeQo CWPYLTTdMrIeXwTUhr/GE8dDLX376RIsWjSkvf05+i1tz5zK9t+jh+svqLrQcQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hYZ0v3vjzz3MG for ; Mon, 31 Aug 2026 16:18:23 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 30646 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 31 Aug 2026 16:18:18 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Nick Price From: Ed Maste Subject: git: 682aec20a214 - stable/15 - aq(4): Fix RSS indirection table OOB write and queue distribution List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: emaste X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 682aec20a2142c1cb45019905b732d61f9659efd Auto-Submitted: auto-generated Date: Mon, 31 Aug 2026 16:18:18 +0000 Message-Id: <6a95a94a.30646.255ebfa5@gitrepo.freebsd.org> The branch stable/15 has been updated by emaste: URL: https://cgit.FreeBSD.org/src/commit/?id=682aec20a2142c1cb45019905b732d61f9659efd commit 682aec20a2142c1cb45019905b732d61f9659efd Author: Nick Price AuthorDate: 2026-06-20 19:02:22 +0000 Commit: Ed Maste CommitDate: 2026-08-31 16:17:57 +0000 aq(4): Fix RSS indirection table OOB write and queue distribution Two related fixes to `aq(4)`'s RSS indirection table handling: 1. Fix an out-of-bounds stack write in `aq_hw_rss_set()`. RSS table entries are 3 bits (8 queues max), but with more than 8 RX rings `rss_table[]` holds larger values; the 32-bit write then spills one `uint16_t` past `bitary[]` and corrupts the stack, so the NIC never links or the kernel panics. Mask each value to 3 bits and pack 16 bits at a time to keep the write in bounds. 2. Build the indirection table in `aq_if_attach_post()` with a modulo over `min(rx_rings_count, HW_ATL_RSS_INDIRECTION_QUEUES_MAX)` instead of `i & (rx_rings_count - 1)`, which assumed a power-of-two ring count. Reviewed by: adrian Differential Revision: https://reviews.freebsd.org/D57240 (cherry picked from commit 57f5252ff8a17aa837f677638cce5885b8a5fb3b) --- sys/dev/aq/aq_hw.c | 12 ++++++++++-- sys/dev/aq/aq_hw.h | 2 ++ sys/dev/aq/aq_main.c | 3 ++- 3 files changed, 14 insertions(+), 3 deletions(-) diff --git a/sys/dev/aq/aq_hw.c b/sys/dev/aq/aq_hw.c index f73805a939cd..5a45e61041c3 100644 --- a/sys/dev/aq/aq_hw.c +++ b/sys/dev/aq/aq_hw.c @@ -878,8 +878,16 @@ aq_hw_rss_set(struct aq_hw_s *self, memset(bitary, 0, sizeof(bitary)); for (i = HW_ATL_RSS_INDIRECTION_TABLE_MAX; i--;) { - (*(uint32_t *)(bitary + ((i * 3U) / 16U))) |= - ((rss_table[i]) << ((i * 3U) & 0xFU)); + uint32_t bit_pos = i * HW_ATL_RSS_INDIRECTION_ENTRY_BITS; + uint32_t word = bit_pos / 16U; + uint32_t shift = bit_pos % 16U; + uint32_t field = (uint32_t)(rss_table[i] & + (HW_ATL_RSS_INDIRECTION_QUEUES_MAX - 1U)) << shift; + + bitary[word] |= (uint16_t)field; + if (shift + HW_ATL_RSS_INDIRECTION_ENTRY_BITS > 16U && + word + 1U < ARRAY_SIZE(bitary)) + bitary[word + 1U] |= (uint16_t)(field >> 16); } for (i = ARRAY_SIZE(bitary); i--;) { diff --git a/sys/dev/aq/aq_hw.h b/sys/dev/aq/aq_hw.h index a4d4dbb3a512..bdd79871fd76 100644 --- a/sys/dev/aq/aq_hw.h +++ b/sys/dev/aq/aq_hw.h @@ -197,6 +197,8 @@ struct aq_hw { #define HW_ATL_RSS_INDIRECTION_TABLE_MAX 64U #define HW_ATL_RSS_HASHKEY_SIZE 40U +#define HW_ATL_RSS_INDIRECTION_QUEUES_MAX 8U +#define HW_ATL_RSS_INDIRECTION_ENTRY_BITS 3U /* PCI core control register */ #define AQ_HW_PCI_REG_CONTROL_6_ADR 0x1014U diff --git a/sys/dev/aq/aq_main.c b/sys/dev/aq/aq_main.c index 2ed9bd050780..e893bb7f73b3 100644 --- a/sys/dev/aq/aq_main.c +++ b/sys/dev/aq/aq_main.c @@ -466,8 +466,9 @@ aq_if_attach_post(if_ctx_t ctx) aq_add_stats_sysctls(softc); /* RSS */ arc4rand(softc->rss_key, HW_ATL_RSS_HASHKEY_SIZE, 0); + uint32_t rss_qs = MIN(softc->rx_rings_count, HW_ATL_RSS_INDIRECTION_QUEUES_MAX); for (int i = ARRAY_SIZE(softc->rss_table); i--;){ - softc->rss_table[i] = i & (softc->rx_rings_count - 1); + softc->rss_table[i] = i % rss_qs; } exit: AQ_DBG_EXIT(rc);