From: Jakub Kicinski <kuba@kernel•org>
To: bhargava.marreddy@broadcom•com
Cc: Jakub Kicinski <kuba@kernel•org>,
pabeni@redhat•com, pavan.chebbi@broadcom•com,
rahul-rg.gupta@broadcom•com, edumazet@google•com,
ajit.khaparde@broadcom•com, linux-kernel@vger•kernel.org,
netdev@vger•kernel.org, vsrama-krishna.nemani@broadcom•com,
andrew+netdev@lunn•ch, horms@kernel•org, davem@davemloft•net,
michael.chan@broadcom•com, rajashekar.hudumula@broadcom•com,
vikas.gupta@broadcom•com
Subject: Re: [v6,net-next,8/8] bng_en: Add support for TPA events
Date: Mon, 26 Jan 2026 19:22:56 -0800 [thread overview]
Message-ID: <20260127032255.3847218-2-kuba@kernel.org> (raw)
In-Reply-To: <20260123193504.285573-9-bhargava.marreddy@broadcom.com>
This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.
For local reproduction steps see https://netdev-ai.bots.linux.dev/ai-local.html
---
bng_en: Add support for TPA events
This commit enables TPA (Transport Protocol Aggregation) functionality
in the VNIC and adds functions to handle TPA events for LRO/GRO
processing.
> +static void bnge_tpa_agg(struct bnge_net *bn, struct bnge_rx_ring_info *rxr,
> + struct rx_agg_cmp *rx_agg)
> +{
> + u16 agg_id = TPA_AGG_AGG_ID(rx_agg);
> + struct bnge_tpa_info *tpa_info;
> +
> + agg_id = bnge_lookup_agg_idx(rxr, agg_id);
> + tpa_info = &rxr->rx_tpa[agg_id];
> +
> + tpa_info->agg_arr[tpa_info->agg_count++] = *rx_agg;
^^^^^^^^^^^^^^^^^^^^^^^^^^
The agg_arr is allocated with MAX_SKB_FRAGS entries, but there is no
bounds check before writing to it. The bnxt driver has a BUG_ON guard
at this location:
BUG_ON(tpa_info->agg_count >= MAX_SKB_FRAGS);
Is there a reason this check was omitted? While the check in
bnge_tpa_end() catches agg_bufs > MAX_SKB_FRAGS, that happens after
the aggregation completions have already been stored. If hardware
misbehaves and sends more aggregation completions than expected, could
this overflow agg_arr[]?
> +}
--
pw-bot: cr
next prev parent reply other threads:[~2026-01-27 3:23 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-23 19:34 [v6, net-next 0/8] bng_en: enhancements for RX and TX datapath Bhargava Marreddy
2026-01-23 19:34 ` [v6, net-next 1/8] bng_en: Extend bnge_set_ring_params() for rx-copybreak Bhargava Marreddy
2026-01-23 19:34 ` [v6, net-next 2/8] bng_en: Add RX support Bhargava Marreddy
2026-01-23 19:34 ` [v6, net-next 3/8] bng_en: Handle an HWRM completion request Bhargava Marreddy
2026-01-23 19:35 ` [v6, net-next 4/8] bng_en: Add TX support Bhargava Marreddy
2026-01-23 19:35 ` [v6, net-next 5/8] bng_en: Add ndo_features_check support Bhargava Marreddy
2026-01-23 19:35 ` [v6, net-next 6/8] bng_en: Add support to handle AGG events Bhargava Marreddy
2026-01-23 19:35 ` [v6, net-next 7/8] bng_en: Add TPA related functions Bhargava Marreddy
2026-01-23 19:35 ` [v6, net-next 8/8] bng_en: Add support for TPA events Bhargava Marreddy
2026-01-27 3:22 ` Jakub Kicinski [this message]
2026-01-27 17:58 ` [v6,net-next,8/8] " Bhargava Chenna Marreddy
2026-01-27 18:47 ` Jakub Kicinski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260127032255.3847218-2-kuba@kernel.org \
--to=kuba@kernel$(echo .)org \
--cc=ajit.khaparde@broadcom$(echo .)com \
--cc=andrew+netdev@lunn$(echo .)ch \
--cc=bhargava.marreddy@broadcom$(echo .)com \
--cc=davem@davemloft$(echo .)net \
--cc=edumazet@google$(echo .)com \
--cc=horms@kernel$(echo .)org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=michael.chan@broadcom$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=pabeni@redhat$(echo .)com \
--cc=pavan.chebbi@broadcom$(echo .)com \
--cc=rahul-rg.gupta@broadcom$(echo .)com \
--cc=rajashekar.hudumula@broadcom$(echo .)com \
--cc=vikas.gupta@broadcom$(echo .)com \
--cc=vsrama-krishna.nemani@broadcom$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox