From nobody Sat Jun 20 19:10:34 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gjPDw3WLVz6hNp9 for ; Sat, 20 Jun 2026 19:10:40 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gjPDv5Ptmz3v43 for ; Sat, 20 Jun 2026 19:10:39 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1781982639; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=etUp6IikYdO2ILXpVAg5wtYjGEPPgLmxgeapc71tGdA=; b=Q3pXRbg1mO7YxLeGFyewgfUUE/fuzmwdUfm3kJrSQGqDWJDlnksqN5EGv+qmiHC6gRLYcx S+epxMrxglAs4RiKXI4/k35kJ5/+SmTLzQtrW7FA0V7Q/B98WHju+JhXq0m6/zmlzJmdU5 8hC2OtTUtyNedh46ltZmx1+zKpDTHVFatj2nlilCtEF/aG3AdsWRxUSlCbosK7uS3fkHs4 eZxbHz+WwyqkKw4HjcOTBiM/uPXUTQoBOod/2pAii2LXajy0GoX2BusT1w7EmKsY2q+kfx YjJam1Ws3xktKcrdE2rFlv7x1OrEqtxEn0DFPaKbTlx/RUlvh2yv7Nbuxeux7w== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1781982639; a=rsa-sha256; cv=none; b=pIWxG4PGWVAL30Y2tgzessO5IPSxAws0y+SxKY7lh64HMNDE7rnG8UTrIBG5Mi0T0YyGBe E1OXLIpiVl5fR2xctSPNNZOSlm0W/rclHmKHjybR6VoW3w+pogoxTRUq+zLtaI5BhLwGAP itHrqKAQ2tZGD45mQEyqiplumnLg3ZEBIqO4k+G/5ZQeO/WdB4c7DtRgFP6cLy6ot61xX8 foYOtLHFcWorW5IDLolxNlqhXasgfq3yfjRz83xL6Z/qpBkT0PtnbOKe8/RiVnS9MAPUJH 29bvLbecvyylw9HCDBeG607cjq19lyu1gz1h14RR+xN+zGbs761opq2WP6ttiQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1781982639; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=etUp6IikYdO2ILXpVAg5wtYjGEPPgLmxgeapc71tGdA=; b=v9n/1H3iApn6azZ5ZcF3TJOap0tl1X+n+7chjElt1JWMCrx6xz2XuSTVz5KPCeardUl/XP /a3wbCr87xvkjfLQ7h/ZNvzY9qFx0W0xMWJWJiLfKMR1g5AqPoYmxXe5N1g1fNyTsBkmol eB+0tW96PyPM/PaIb/z9oVJ/rWolTRA21i8nqZeRhuZsfcxxXzdEpr9RZj8lgntUjGv5jQ pIAjOPthK0vOLba28nxvCCGFF2/aw9QmSeEsYgJNqlUJEuS8ridbqolh/miyRm5gMarR18 /AA3/9EtH8GDYSo9JvxBDFS+S6kZKN0qQVP+Y1qihAyaYboIf4+wICjJwZkFJg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gjPDv4QDyzk6T for ; Sat, 20 Jun 2026 19:10:39 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3364c by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sat, 20 Jun 2026 19:10:34 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: Nick Price From: Adrian Chadd Subject: git: 57f5252ff8a1 - main - aq(4): Fix RSS indirection table OOB write and queue distribution List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: adrian X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 57f5252ff8a17aa837f677638cce5885b8a5fb3b Auto-Submitted: auto-generated Date: Sat, 20 Jun 2026 19:10:34 +0000 Message-Id: <6a36e5aa.3364c.1c16886e@gitrepo.freebsd.org> The branch main has been updated by adrian: URL: https://cgit.FreeBSD.org/src/commit/?id=57f5252ff8a17aa837f677638cce5885b8a5fb3b commit 57f5252ff8a17aa837f677638cce5885b8a5fb3b Author: Nick Price AuthorDate: 2026-06-20 19:02:22 +0000 Commit: Adrian Chadd CommitDate: 2026-06-20 19:10:15 +0000 aq(4): Fix RSS indirection table OOB write and queue distribution Two related fixes to `aq(4)`'s RSS indirection table handling: 1. Fix an out-of-bounds stack write in `aq_hw_rss_set()`. RSS table entries are 3 bits (8 queues max), but with more than 8 RX rings `rss_table[]` holds larger values; the 32-bit write then spills one `uint16_t` past `bitary[]` and corrupts the stack, so the NIC never links or the kernel panics. Mask each value to 3 bits and pack 16 bits at a time to keep the write in bounds. 2. Build the indirection table in `aq_if_attach_post()` with a modulo over `min(rx_rings_count, HW_ATL_RSS_INDIRECTION_QUEUES_MAX)` instead of `i & (rx_rings_count - 1)`, which assumed a power-of-two ring count. Reviewed by: adrian Differential Revision: https://reviews.freebsd.org/D57240 --- sys/dev/aq/aq_hw.c | 12 ++++++++++-- sys/dev/aq/aq_hw.h | 2 ++ sys/dev/aq/aq_main.c | 3 ++- 3 files changed, 14 insertions(+), 3 deletions(-) diff --git a/sys/dev/aq/aq_hw.c b/sys/dev/aq/aq_hw.c index f73805a939cd..5a45e61041c3 100644 --- a/sys/dev/aq/aq_hw.c +++ b/sys/dev/aq/aq_hw.c @@ -878,8 +878,16 @@ aq_hw_rss_set(struct aq_hw_s *self, memset(bitary, 0, sizeof(bitary)); for (i = HW_ATL_RSS_INDIRECTION_TABLE_MAX; i--;) { - (*(uint32_t *)(bitary + ((i * 3U) / 16U))) |= - ((rss_table[i]) << ((i * 3U) & 0xFU)); + uint32_t bit_pos = i * HW_ATL_RSS_INDIRECTION_ENTRY_BITS; + uint32_t word = bit_pos / 16U; + uint32_t shift = bit_pos % 16U; + uint32_t field = (uint32_t)(rss_table[i] & + (HW_ATL_RSS_INDIRECTION_QUEUES_MAX - 1U)) << shift; + + bitary[word] |= (uint16_t)field; + if (shift + HW_ATL_RSS_INDIRECTION_ENTRY_BITS > 16U && + word + 1U < ARRAY_SIZE(bitary)) + bitary[word + 1U] |= (uint16_t)(field >> 16); } for (i = ARRAY_SIZE(bitary); i--;) { diff --git a/sys/dev/aq/aq_hw.h b/sys/dev/aq/aq_hw.h index a4d4dbb3a512..bdd79871fd76 100644 --- a/sys/dev/aq/aq_hw.h +++ b/sys/dev/aq/aq_hw.h @@ -197,6 +197,8 @@ struct aq_hw { #define HW_ATL_RSS_INDIRECTION_TABLE_MAX 64U #define HW_ATL_RSS_HASHKEY_SIZE 40U +#define HW_ATL_RSS_INDIRECTION_QUEUES_MAX 8U +#define HW_ATL_RSS_INDIRECTION_ENTRY_BITS 3U /* PCI core control register */ #define AQ_HW_PCI_REG_CONTROL_6_ADR 0x1014U diff --git a/sys/dev/aq/aq_main.c b/sys/dev/aq/aq_main.c index 2ed9bd050780..e893bb7f73b3 100644 --- a/sys/dev/aq/aq_main.c +++ b/sys/dev/aq/aq_main.c @@ -466,8 +466,9 @@ aq_if_attach_post(if_ctx_t ctx) aq_add_stats_sysctls(softc); /* RSS */ arc4rand(softc->rss_key, HW_ATL_RSS_HASHKEY_SIZE, 0); + uint32_t rss_qs = MIN(softc->rx_rings_count, HW_ATL_RSS_INDIRECTION_QUEUES_MAX); for (int i = ARRAY_SIZE(softc->rss_table); i--;){ - softc->rss_table[i] = i & (softc->rx_rings_count - 1); + softc->rss_table[i] = i % rss_qs; } exit: AQ_DBG_EXIT(rc);