From nobody Fri Oct 09 10:12:51 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j1N394N8Vz6vRZH for ; Fri, 09 Oct 2026 10:12:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4j1N380MpLz4YLt for ; Fri, 09 Oct 2026 10:12:52 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791540772; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=JKyaYCOQ4LRZJWrXiv1UokGPKjiOghBII16J12dM1+8=; b=hEol4/4vE9/rLJBjRBLeTEcWXAy6w7LSWd+/3ISl3MqCS0kaiqq+cUkaqukJ5/Sx9a0KeX YMy2WAjcSYhQjpziG9yLMHfJCylsKLFZ+eoPetAfaczhWIRBWtwTb32j0Sc3vYswVZGVQb 7RrTXIAwTHjCnKcb6VjK5vVDHr48DT3vVQtJl8yWL28Y6NBEMcc+NM0GMEcqWf6OPX/fsr 7+lQzToYaSApILj5S7mH9vV0r5u2UlA5K6pccROQ2cDeu2TtPHR2LBHZOFeg3kHs45k4t1 CKIbcOcqmNPyxS7Lht8uDGhX+gLiWLqqHHDCDjjHoskoos/DrljlL8TDCtBicA== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791540772; b=hmnTX5SrNMI9lnmwbYirlaVH2uAEX7pRpWYmLmKQG22WTwDVUIg90EJ2VQhYvEG7qKJOZy gMBtxAmndWTOSk2SiaOUjNxtZLeITUnW213EEvUWkwCepWgicXKqy/RlQeuwuIWRt6JIWH S0g7jbUoA//mjU5ytE2m0iHD34XXmlttEwLBg8YEZ7NjYOC51mvb/DORaO6Tl4+j5Ar20a gMDJjJxFMv0PfUfDCM8X5ws71IdRhAKEs1NqT6Cjsbt4JEfliMg16iV+cUHKoAROVNMF5+ 8OMIQ1mmDusvM2pd5sMSliE5/ExfzetXa9Uf73dFgMpbYqnfTlUPZ8QOlgkyGA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791540772; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=JKyaYCOQ4LRZJWrXiv1UokGPKjiOghBII16J12dM1+8=; b=nkYzaMnMeU2naXO/euPUUMiWm7AyEnDE98PDT6S4aEVJzjjcyP5pMn1SmWvMWdvmrARKaO UKieVqwdmee4UgSmU42XlG8zxiFBZXIgX26hedzd/lVImV7YlCiPYi2FCqBxmAjJ80NrK6 JOTBcr2TSQkGQ3GIvHflCuXymMKnlPAtAVLMUPv/Te7T3zTc5fgxlqqef05vdPj0ndsyVz deI1k2JKvu/5lZgPTRSxsbzHq420na1JUBBNnEP588WGpZ2uRKHExSZrPn8DEUP/c0b9xW AAfINxMCj5EEl34OnVPRfjWDNkpJl9xqB3TSdMQ1eaOG8IVES9kfuVoE3EoCbQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j1N372GNHz1L1M for ; Fri, 09 Oct 2026 10:12:51 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 4295f by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 09 Oct 2026 10:12:51 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: Sumit Saxena From: Sumit Saxena Subject: git: f2ce672ade23 - main - if_bnxt: avoid FTQM/STQM pg_info alias on reset List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: ssaxena X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: f2ce672ade231a1e19f1238922a2c3b6fe696e22 Auto-Submitted: auto-generated Date: Fri, 09 Oct 2026 10:12:51 +0000 Message-Id: <6ac8be23.4295f.b6a4202@gitrepo.freebsd.org> The branch main has been updated by ssaxena: URL: https://cgit.FreeBSD.org/src/commit/?id=f2ce672ade231a1e19f1238922a2c3b6fe696e22 commit f2ce672ade231a1e19f1238922a2c3b6fe696e22 Author: Sumit Saxena AuthorDate: 2026-07-31 16:02:18 +0000 Commit: Sumit Saxena CommitDate: 2026-10-09 08:24:44 +0000 if_bnxt: avoid FTQM/STQM pg_info alias on reset Copying the STQM backing-store context to seed FTQM's also copied STQM's pg_info pointer verbatim. On cold load STQM's pg_info is still NULL so this is harmless, but on a firmware reset STQM's pg_info is already non-NULL, making FTQM alias STQM's backing-store pages. The allocator then skips FTQM since it looks already allocated, and FTQM is later indexed as its own array, reading out of bounds into STQM's buffer and dereferencing a bogus DMA address. Clear ctxm->pg_info after the memcpy so FTQM always gets its own backing store. Reviewed by: gallatin MFC after: 2 weeks Sponsored by: Broadcom Inc. Differential Revision: https://reviews.freebsd.org/D58615 --- sys/dev/bnxt/bnxt_en/bnxt_hwrm.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sys/dev/bnxt/bnxt_en/bnxt_hwrm.c b/sys/dev/bnxt/bnxt_en/bnxt_hwrm.c index 73afb62b21ad..19f2a8c80485 100644 --- a/sys/dev/bnxt/bnxt_en/bnxt_hwrm.c +++ b/sys/dev/bnxt/bnxt_en/bnxt_hwrm.c @@ -597,6 +597,9 @@ int bnxt_hwrm_func_backing_store_qcaps(struct bnxt_softc *softc) memcpy(ctxm, &ctx->ctx_arr[BNXT_CTX_STQM], sizeof(*ctxm)); ctxm->instance_bmap = (1 << ctx->tqm_fp_rings_count) - 1; + /* Do not inherit STQM's pg_info pointer (prevents aliasing on reset). */ + ctxm->pg_info = NULL; + rc = bnxt_alloc_all_ctx_pg_info(softc, BNXT_CTX_MAX); } else { rc = 0;