git: f2ce672ade23 - main - if_bnxt: avoid FTQM/STQM pg_info alias on reset

The branch main has been updated by ssaxena:

URL: https://cgit.FreeBSD.org/src/commit/?id=f2ce672ade231a1e19f1238922a2c3b6fe696e22

commit f2ce672ade231a1e19f1238922a2c3b6fe696e22
Author:     Sumit Saxena <sumit.saxena@broadcom.com>
AuthorDate: 2026-07-31 16:02:18 +0000
Commit:     Sumit Saxena <ssaxena@FreeBSD.org>
CommitDate: 2026-10-09 08:24:44 +0000

    if_bnxt: avoid FTQM/STQM pg_info alias on reset
    
    Copying the STQM backing-store context to seed FTQM's also copied
    STQM's pg_info pointer verbatim. On cold load STQM's pg_info is still
    NULL so this is harmless, but on a firmware reset STQM's pg_info is
    already non-NULL, making FTQM alias STQM's backing-store pages. The
    allocator then skips FTQM since it looks already allocated, and FTQM
    is later indexed as its own array, reading out of bounds into STQM's
    buffer and dereferencing a bogus DMA address.
    
    Clear ctxm->pg_info after the memcpy so FTQM always gets its own
    backing store.
    
    Reviewed by:    gallatin
    MFC after:      2 weeks
    Sponsored by:   Broadcom Inc.
    Differential Revision:  https://reviews.freebsd.org/D58615
---
 sys/dev/bnxt/bnxt_en/bnxt_hwrm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sys/dev/bnxt/bnxt_en/bnxt_hwrm.c b/sys/dev/bnxt/bnxt_en/bnxt_hwrm.c
index 73afb62b21ad..19f2a8c80485 100644
--- a/sys/dev/bnxt/bnxt_en/bnxt_hwrm.c
+++ b/sys/dev/bnxt/bnxt_en/bnxt_hwrm.c
@@ -597,6 +597,9 @@ int bnxt_hwrm_func_backing_store_qcaps(struct bnxt_softc *softc)
 		memcpy(ctxm, &ctx->ctx_arr[BNXT_CTX_STQM], sizeof(*ctxm));
 		ctxm->instance_bmap = (1 << ctx->tqm_fp_rings_count) - 1;
 
+		/* Do not inherit STQM's pg_info pointer (prevents aliasing on reset). */
+		ctxm->pg_info = NULL;
+
 		rc = bnxt_alloc_all_ctx_pg_info(softc, BNXT_CTX_MAX);
 	} else {
 		rc = 0;