From nobody Fri Oct 23 10:12:03 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j9zMm0fqjz6wgfH for ; Fri, 23 Oct 2026 10:12:04 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4j9zMl52Lxz4cDp for ; Fri, 23 Oct 2026 10:12:03 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792750323; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=qgSDL2SfXyFMVN5pCfWoWIls0WeRhaMiik8R9h8vHW8=; b=yGwgTKSjpzPE3aEE9E22FYtI5s1BW09WStMvrjzJvlVnPnCL3q2S+GFPixARz0k1ajdzj5 qVKjoKhiSSAxFb6l3i4CiDuACsmLDoACtRKd729hJsHBzh3j1E6AWrXzQ7EuOW8mNa+Yeo M9auKfe0tSXuLPehqADXufqzVfCF4AjV1bINk38Rti87/MycsG9CxXq/7UpZxoEcbTcM80 SIJG3qoEch6s43WnKHGqpZHI7pSgSRJ8aXNgN+n6wsGb8Gs61SlILNzqYgLscpx17mSs8d IF5f6AOFfkUJu3eI5+9ljl80Dyg+bH2fx3tcbGGGKWXaV4vF8WhuP1wa1X7Z0w== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1792750323; b=LripGf48QfGSvrXxdZvNz2Pz/f8w+xwucOmAmm78f+57YDxCCFFXlLvoQeFaMnPNyIO5oi l6oLFhXERQHDMHrc++WmeCkTiWTWrLRCkDk68qwyBPd+Ljjd55hulT5GVQud8TJruEDkZV kZ48ECrubSPVKWJPAa6qhE+i0gZVnjZc6BsP5TQrs+LrFHTMdCsFjusfTFPrsssO8KWeFu nETUj12nGNOmJPPaCbbITVaAy8q2qsW7fIAIQY881n/dWczA2XR4TjonkWA+Q6I6JkMzm8 MLl+0DRZpX26VDt/JEr5qK050s4PB8Qn3cjQQeQrdlT/eBTJpudBMI+NXrYbqQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792750323; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=qgSDL2SfXyFMVN5pCfWoWIls0WeRhaMiik8R9h8vHW8=; b=mXLyRH9xVaTLzvHZ94XH3zwd7SPA8OQy3hAG6q2jIlgyLKF633ux7+PlB/cv0FsuJMcmVI KiGtcky2U5zPs+UtdYI1vxxiEtLjmrQuKSt148EeYZw9VlX0WsWCknYQZsFpfFr9H/B+FK /cLTs21cyXpydIs+gNATRcmYdI9HhAQHFMmuyXfS6OUdnnj3VwKX+tZ0NFk2O+v25ST6bL ADfq9JMWMSerEzVR/neB6KyqlPdlofZVuUNSxrQnHdswADXorP/axyU9sa9qOhzSTXs0Yf wEnOcAFuVKoXUoZbxizEFgvtV0MhqA1k1mOWXQkejAIfunMXhnkC0DMWjHicZQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j9zMl4MwLzN3f for ; Fri, 23 Oct 2026 10:12:03 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 392be by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 23 Oct 2026 10:12:03 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Sumit Saxena From: Sumit Saxena Subject: git: 30c45bb80f78 - stable/15 - if_bnxt: avoid FTQM/STQM pg_info alias on reset List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: ssaxena X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 30c45bb80f78ed8166be2209bb2df617f8249070 Auto-Submitted: auto-generated Date: Fri, 23 Oct 2026 10:12:03 +0000 Message-Id: <6adb32f3.392be.76ddef26@gitrepo.freebsd.org> The branch stable/15 has been updated by ssaxena: URL: https://cgit.FreeBSD.org/src/commit/?id=30c45bb80f78ed8166be2209bb2df617f8249070 commit 30c45bb80f78ed8166be2209bb2df617f8249070 Author: Sumit Saxena AuthorDate: 2026-07-31 16:02:18 +0000 Commit: Sumit Saxena CommitDate: 2026-10-23 10:11:37 +0000 if_bnxt: avoid FTQM/STQM pg_info alias on reset Copying the STQM backing-store context to seed FTQM's also copied STQM's pg_info pointer verbatim. On cold load STQM's pg_info is still NULL so this is harmless, but on a firmware reset STQM's pg_info is already non-NULL, making FTQM alias STQM's backing-store pages. The allocator then skips FTQM since it looks already allocated, and FTQM is later indexed as its own array, reading out of bounds into STQM's buffer and dereferencing a bogus DMA address. Clear ctxm->pg_info after the memcpy so FTQM always gets its own backing store. Reviewed by: gallatin MFC after: 2 weeks Sponsored by: Broadcom Inc. Differential Revision: https://reviews.freebsd.org/D58615 (cherry picked from commit f2ce672ade231a1e19f1238922a2c3b6fe696e22) --- sys/dev/bnxt/bnxt_en/bnxt_hwrm.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sys/dev/bnxt/bnxt_en/bnxt_hwrm.c b/sys/dev/bnxt/bnxt_en/bnxt_hwrm.c index 7313a4e33834..d78e28cf59e0 100644 --- a/sys/dev/bnxt/bnxt_en/bnxt_hwrm.c +++ b/sys/dev/bnxt/bnxt_en/bnxt_hwrm.c @@ -595,6 +595,9 @@ int bnxt_hwrm_func_backing_store_qcaps(struct bnxt_softc *softc) memcpy(ctxm, &ctx->ctx_arr[BNXT_CTX_STQM], sizeof(*ctxm)); ctxm->instance_bmap = (1 << ctx->tqm_fp_rings_count) - 1; + /* Do not inherit STQM's pg_info pointer (prevents aliasing on reset). */ + ctxm->pg_info = NULL; + rc = bnxt_alloc_all_ctx_pg_info(softc, BNXT_CTX_MAX); } else { rc = 0;