ACK: [SRU][J][PATCH 0/1] CVE-2025-39810

[Andrei Gherzan]

On 2026/09/19 12:26AM, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2025-39810
> 
> [ Impact ]
> 
> In the Linux kernel, the following vulnerability has been resolved:
> 
> bnxt_en: Fix memory corruption when FW resources change during ifdown
> 
> bnxt_set_dflt_rings() assumes that it is always called before any TC has been
> created. So it doesn't take bp->num_tc into account and assumes that it is
> always 0 or 1.
> 
> In the FW resource or capability change scenario, the FW will return flags in
> bnxt_hwrm_if_change() that will cause the driver to reinitialize and call
> bnxt_cancel_reservations(). This will lead to bnxt_init_dflt_ring_mode()
> calling bnxt_set_dflt_rings() and bp->num_tc may be greater than 1. This will
> cause bp->tx_ring[] to be sized too small and cause memory corruption in
> bnxt_alloc_cp_rings().
> 
> Fix it by properly scaling the TX rings by bp->num_tc in the code paths
> mentioned above. Add 2 helper functions to determine bp->tx_nr_rings and
> bp->tx_nr_rings_per_tc.
> 
> [ Fix ]
> 
> jammy/linux: backported from 2747328ba271
> 
> The jammy tree has no bp->num_tc field, so the two new helper functions use
> netdev_get_num_tc(bp->dev), the TC-count analogue already used elsewhere in
> this driver (for example in bnxt_reserve_rings), instead of bp->num_tc. The
> unrelated bnxt_cfg_one_usr_fltr/bnxt_cfg_usr_fltrs/bnxt_set_xps_mapping
> functions that git am spuriously pulled into the conflict block were dropped,
> as they belong to other commits and do not exist in this tree.
> 
> [ Test Plan ]
> 
> Build and boot tested.
> 
> [ Where Problems Could Occur ]
> 
> A bad fix would affect systems using Broadcom NetXtreme-C/E (bnxt_en) network
> adapters, specifically those configured with more than one traffic class
> (multiple TX queues per TC) that go through a firmware resource or capability
> change while the interface is being brought down and reinitialized. A
> regression could manifest as an incorrect number of TX rings being allocated,
> leading to transmit failures or ring misconfiguration. Systems without
> Broadcom bnxt_en hardware are not affected, and systems using a single
> traffic class exercise the same ring-count arithmetic as before.
> 
> [ Other Info ]
> 
> Kybele flow-v12-16-g3521c8c5. Reference: b0135a45/v1

Acked-by: Andrei Gherzan <andrei.gherzan at canonical.com>

-- 
Andrei Gherzan
gpg: rsa4096/D4D94F67AD0E9640
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260921/0b236239/attachment.sig>