From e8f6ca11167d4753386340ce88444b5445dff831 Mon Sep 17 00:00:00 2001 From: Dharmender Garg Date: Mon, 26 Oct 2026 14:57:56 +0530 Subject: [PATCH] bnge: cap RSS contexts and RX rings to the RSS table size The hardware supports at most BNGE_RSS_TABLE_MAX_TBL (8) RSS contexts. They are stored in vnic->fw_rss_cos_lb_ctx[8] and back a 512-entry (BNGE_MAX_RSS_TABLE_ENTRIES) indirection table and DMA buffer, so at most 512 RX rings can be served by RSS. bnge_cal_nr_rss_ctxs() has no upper bound, so with more RX rings it returns more than 8 contexts: bnge_setup_vnic() writes past fw_rss_cos_lb_ctx[], bnge_set_dflt_rss_indir_tbl() and bnge_fill_hw_rss_tbl() write past the indirection table and its DMA buffer, and the pad computation in bnge_set_dflt_rss_indir_tbl() underflows into a huge memset(). Cap the number of contexts at BNGE_RSS_TABLE_MAX_TBL and the number of RX rings at BNGE_MAX_RSS_TABLE_ENTRIES, so the sizes derived from the ring count always fit the arrays. Fixes: 627c67f038d2 ("bng_en: Add resource management support") Signed-off-by: Dharmender Garg Reviewed-by: Vikas Gupta Reviewed-by: Simon Horman Link: https://patch.msgid.link/20261026092757.9168-2-vikas.gupta@broadcom.com Signed-off-by: Jakub Kicinski --- drivers/net/ethernet/broadcom/bnge/bnge_resc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/broadcom/bnge/bnge_resc.c b/drivers/net/ethernet/broadcom/bnge/bnge_resc.c index 7c26943c5cb3..65ef34536e36 100644 --- a/drivers/net/ethernet/broadcom/bnge/bnge_resc.c +++ b/drivers/net/ethernet/broadcom/bnge/bnge_resc.c @@ -182,8 +182,9 @@ int bnge_cal_nr_rss_ctxs(u16 rx_rings) if (!rx_rings) return 0; - return bnge_adjust_pow_two(rx_rings - 1, - BNGE_RSS_TABLE_ENTRIES); + return min_t(int, bnge_adjust_pow_two(rx_rings - 1, + BNGE_RSS_TABLE_ENTRIES), + BNGE_RSS_TABLE_MAX_TBL); } static u16 bnge_rss_ctxs_in_use(struct bnge_dev *bd, @@ -459,6 +460,7 @@ static void _bnge_get_max_rings(struct bnge_dev *bd, u16 *max_rx, } *max_rx = min_t(int, *max_rx, max_ring_grps); + *max_rx = min_t(int, *max_rx, BNGE_MAX_RSS_TABLE_ENTRIES); } static int bnge_get_max_rings(struct bnge_dev *bd, u16 *max_rx,