[PATCH net 0/3] octeontx2: Misc fixes for RVU drivers

[PATCH net 0/3] octeontx2: Misc fixes for RVU drivers

[Subrat Pandey]

A few independent fixes for the Marvell OcteonTX2 (RVU AF/PF) drivers:

 - Fix a potential buffer overrun by replacing the unbounded sprintf()
   for the "mcs%d" debugfs name with snprintf().
 - Fix aura/CQ BPID assignment under CONFIG_DCB, which assumed
   queue_to_pfc_map was always allocated (not true for SDP VFs).
 - Fix the SC resource cleanup loop that iterated over secy.max
   instead of sc.max.

Baha Mesleh (1):
  octeontx2-af: mcs: Fix SC resource cleanup loop

Geetha sowjanya (1):
  octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled

Stefan Wiehler (1):
  octeontx2-af: Fix mcs string buffer size

 drivers/net/ethernet/marvell/octeontx2/af/mcs.c     |  2 +-
 .../net/ethernet/marvell/octeontx2/af/rvu_debugfs.c |  4 ++--
 drivers/net/ethernet/marvell/octeontx2/nic/cn20k.c  |  8 +++++---
 .../ethernet/marvell/octeontx2/nic/otx2_common.c    | 13 +++++++------
 4 files changed, 15 insertions(+), 12 deletions(-)

-- 
2.43.0

[PATCH net 1/3] octeontx2-af: Fix mcs string buffer size

[Subrat Pandey]

From: Stefan Wiehler <stefan.wiehler@nokia.com>

The "mcs%d" name is built with the unbounded sprintf(), which writes
without any regard for the size of the destination buffer and can
overrun it. Switch to snprintf() with sizeof() so the formatted write
is always clamped to the buffer. The buffer is also enlarged to
24 bytes to comfortably hold the string for any MCS block index.

Fixes: d06c2aba5163 ("octeontx2-af: cn10k: mcs: Add debugfs support").
Signed-off-by: Stefan Wiehler <stefan.wiehler@nokia.com>
Signed-off-by: Subrat Pandey <subratp@marvell.com>
---
 drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
index 3456313d3b3c..a13848f26ae9 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
@@ -497,7 +497,7 @@ RVU_DEBUG_SEQ_FOPS(mcs_rx_secy_stats, mcs_rx_secy_stats_display, NULL);
 static void rvu_dbg_mcs_init(struct rvu *rvu)
 {
 	struct mcs *mcs;
-	char dname[10];
+	char dname[24];
 	int i;
 
 	if (!rvu->mcs_blk_cnt)
@@ -508,7 +508,7 @@ static void rvu_dbg_mcs_init(struct rvu *rvu)
 	for (i = 0; i < rvu->mcs_blk_cnt; i++) {
 		mcs = mcs_get_pdata(i);
 
-		sprintf(dname, "mcs%d", i);
+		snprintf(dname, sizeof(dname), "mcs%d", i);
 		rvu->rvu_dbg.mcs = debugfs_create_dir(dname,
 						      rvu->rvu_dbg.mcs_root);
 
-- 
2.43.0

[PATCH net 2/3] octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled

[Subrat Pandey]

From: Geetha sowjanya <gakula@marvell.com>

Previously, BPID assignment under CONFIG_DCB assumed
`queue_to_pfc_map` was always initialized. For SDP VFs this leads to
invalid memory access as it was not initialized.

This patch adds a NULL check for `queue_to_pfc_map` before
dereferencing it. Also, simplifies the logic by always assigning a
default BPID first, then conditionally overriding it if CONFIG_DCB is
enabled and the map exists.

Fixes: 184fb40f731b ("octeontx2-pf: Avoid adding dcbnl_ops for LBK and SDP vf").
Signed-off-by: Geetha sowjanya <gakula@marvell.com>
Signed-off-by: Subrat Pandey <subratp@marvell.com>
---
 drivers/net/ethernet/marvell/octeontx2/nic/cn20k.c  |  8 +++++---
 .../ethernet/marvell/octeontx2/nic/otx2_common.c    | 13 +++++++------
 2 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/cn20k.c b/drivers/net/ethernet/marvell/octeontx2/nic/cn20k.c
index dbf173196608..f3903cce9bf7 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/cn20k.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/cn20k.c
@@ -245,10 +245,12 @@ int cn20k_register_pfvf_mbox_intr(struct otx2_nic *pf, int numvfs)
 static u8 cn20k_aura_bpid_idx(struct otx2_nic *pfvf, int aura_id)
 {
 #ifdef CONFIG_DCB
-	return pfvf->queue_to_pfc_map[aura_id];
-#else
-	return 0;
+	if (pfvf->queue_to_pfc_map)
+		return pfvf->queue_to_pfc_map[aura_id];
+	else
+		return 0;
 #endif
+	return 0;
 }
 
 static int cn20k_tc_get_entry_index(struct otx2_flow_config *flow_cfg,
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
index 3d253132a17f..b4691472d2a3 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
@@ -1132,10 +1132,10 @@ int otx2_cq_init(struct otx2_nic *pfvf, u16 qidx)
 		if (!is_otx2_lbkvf(pfvf->pdev)) {
 			/* Enable receive CQ backpressure */
 			aq->cq.bp_ena = 1;
-#ifdef CONFIG_DCB
-			aq->cq.bpid = pfvf->bpid[pfvf->queue_to_pfc_map[qidx]];
-#else
 			aq->cq.bpid = pfvf->bpid[0];
+#ifdef CONFIG_DCB
+			if (pfvf->queue_to_pfc_map)
+				aq->cq.bpid = pfvf->bpid[pfvf->queue_to_pfc_map[qidx]];
 #endif
 
 			/* Set backpressure level is same as cq pass level */
@@ -1433,10 +1433,11 @@ int otx2_aura_aq_init(struct otx2_nic *pfvf, int aura_id,
 		 */
 		if (pfvf->nix_blkaddr == BLKADDR_NIX1)
 			aq->aura.bp_ena = 1;
-#ifdef CONFIG_DCB
-		aq->aura.nix0_bpid = pfvf->bpid[pfvf->queue_to_pfc_map[aura_id]];
-#else
+
 		aq->aura.nix0_bpid = pfvf->bpid[0];
+#ifdef CONFIG_DCB
+		if (pfvf->queue_to_pfc_map)
+			aq->aura.nix0_bpid = pfvf->bpid[pfvf->queue_to_pfc_map[aura_id]];
 #endif
 
 		/* Set backpressure level for RQ's Aura */
-- 
2.43.0

[PATCH net 3/3] octeontx2-af: mcs: Fix SC resource cleanup loop

[Subrat Pandey]

From: Baha Mesleh <baha.mesleh@nokia.com>

The SC resource cleanup loop was incorrectly iterating over secy.max
instead of sc.max. This patch fixes to use correct value.

Fixes: cfc14181d497 ("octeontx2-af: cn10k: mcs: Manage the MCS block hardware resources").
Signed-off-by: Baha Mesleh <baha.mesleh@nokia.com>
Signed-off-by: Subrat Pandey <subratp@marvell.com>
---
 drivers/net/ethernet/marvell/octeontx2/af/mcs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mcs.c b/drivers/net/ethernet/marvell/octeontx2/af/mcs.c
index a07e0b3d8d00..88658c07c391 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/mcs.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/mcs.c
@@ -738,7 +738,7 @@ int mcs_free_all_rsrc(struct mcs *mcs, int dir, u16 pcifunc)
 	}
 
 	/* free sc entries */
-	for (id = 0; id < map->secy.max; id++) {
+	for (id = 0; id < map->sc.max; id++) {
 		if (map->sc2pf_map[id] != pcifunc)
 			continue;
 		mcs_free_rsrc(&map->sc, map->sc2pf_map, id, pcifunc);
-- 
2.43.0

RE: [PATCH net 1/3] octeontx2-af: Fix mcs string buffer size

[Jagielski, Jedrzej]

From: Subrat Pandey <subratp@marvell.com> 
Sent: Wednesday, July 29, 2026 9:24 AM

>From: Stefan Wiehler <stefan.wiehler@nokia.com>
>
>The "mcs%d" name is built with the unbounded sprintf(), which writes
>without any regard for the size of the destination buffer and can
>overrun it. Switch to snprintf() with sizeof() so the formatted write
>is always clamped to the buffer. The buffer is also enlarged to
>24 bytes to comfortably hold the string for any MCS block index.

Hi Subrat

Is this something that can actually occur during any real scenario?

>
>Fixes: d06c2aba5163 ("octeontx2-af: cn10k: mcs: Add debugfs support").
>Signed-off-by: Stefan Wiehler <stefan.wiehler@nokia.com>
>Signed-off-by: Subrat Pandey <subratp@marvell.com>