[SRU][J][PATCH 0/1] CVE-2025-39810

[Cengiz Can]

https://ubuntu.com/security/CVE-2025-39810

[ Impact ]

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Fix memory corruption when FW resources change during ifdown

bnxt_set_dflt_rings() assumes that it is always called before any TC has been
created. So it doesn't take bp->num_tc into account and assumes that it is
always 0 or 1.

In the FW resource or capability change scenario, the FW will return flags in
bnxt_hwrm_if_change() that will cause the driver to reinitialize and call
bnxt_cancel_reservations(). This will lead to bnxt_init_dflt_ring_mode()
calling bnxt_set_dflt_rings() and bp->num_tc may be greater than 1. This will
cause bp->tx_ring[] to be sized too small and cause memory corruption in
bnxt_alloc_cp_rings().

Fix it by properly scaling the TX rings by bp->num_tc in the code paths
mentioned above. Add 2 helper functions to determine bp->tx_nr_rings and
bp->tx_nr_rings_per_tc.

[ Fix ]

jammy/linux: backported from 2747328ba271

The jammy tree has no bp->num_tc field, so the two new helper functions use
netdev_get_num_tc(bp->dev), the TC-count analogue already used elsewhere in
this driver (for example in bnxt_reserve_rings), instead of bp->num_tc. The
unrelated bnxt_cfg_one_usr_fltr/bnxt_cfg_usr_fltrs/bnxt_set_xps_mapping
functions that git am spuriously pulled into the conflict block were dropped,
as they belong to other commits and do not exist in this tree.

[ Test Plan ]

Build and boot tested.

[ Where Problems Could Occur ]

A bad fix would affect systems using Broadcom NetXtreme-C/E (bnxt_en) network
adapters, specifically those configured with more than one traffic class
(multiple TX queues per TC) that go through a firmware resource or capability
change while the interface is being brought down and reinitialized. A
regression could manifest as an incorrect number of TX rings being allocated,
leading to transmit failures or ring misconfiguration. Systems without
Broadcom bnxt_en hardware are not affected, and systems using a single
traffic class exercise the same ring-count arithmetic as before.

[ Other Info ]

Kybele flow-v12-16-g3521c8c5. Reference: b0135a45/v1