CVE-2025-39810

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Fix memory corruption when FW resources change during ifdown

bnxt_set_dflt_rings() assumes that it is always called before any TC has

been created. So it doesn't take bp->num_tc into account and assumes

that it is always 0 or 1.

In the FW resource or capability change scenario, the FW will return

flags in bnxt_hwrm_if_change() that will cause the driver to

reinitialize and call bnxt_cancel_reservations(). This will lead to

bnxt_init_dflt_ring_mode() calling bnxt_set_dflt_rings() and bp->num_tc

may be greater than 1. This will cause bp->tx_ring[] to be sized too

small and cause memory corruption in bnxt_alloc_cp_rings().

Fix it by properly scaling the TX rings by bp->num_tc in the code

paths mentioned above. Add 2 helper functions to determine

bp->tx_nr_rings and bp->tx_nr_rings_per_tc.