From: Kishore Padmanabha <[email protected]>
Three independent out-of-bounds issues:
- bnxt_rx_pkt() incremented tpa_info->agg_count and indexed
tpa_info->agg_arr[] with only an RTE_ASSERT (compiled out in release
builds) guarding the array bound, allowing an out-of-bounds write if
firmware sent more aggregation segments than TPA_MAX_NUM_SEGS.
- bnxt_rx_descriptor_status_op() used the firmware-supplied completion
opaque value directly as an rx_buf_ring[] index without masking it to
the ring size first.
- bnxt_hwrm_func_vf_vnic_query() returned the firmware-reported
vnic_id_cnt unclamped; a value exceeding bp->pf->total_vnics would
cause the caller to iterate past the end of its VNIC ID buffer.
Fixes: b150a7e7ee ("net/bnxt: support LRO on Thor adapters")
Fixes: 0fe613bb87 ("net/bnxt: support Rx descriptor status")
Fixes: cbcd375d37 ("net/bnxt: fix HWRM macros and locking")
Cc: [email protected]
Signed-off-by: Kishore Padmanabha <[email protected]>
Signed-off-by: Mohammad Shuab Siddique <[email protected]>
---
drivers/net/bnxt/bnxt_ethdev.c | 3 ++-
drivers/net/bnxt/bnxt_hwrm.c | 3 ++-
drivers/net/bnxt/bnxt_rxr.c | 10 +++++++++-
3 files changed, 13 insertions(+), 3 deletions(-)
diff --git a/drivers/net/bnxt/bnxt_ethdev.c b/drivers/net/bnxt/bnxt_ethdev.c
index db9b49238a..d21ebac0c2 100644
--- a/drivers/net/bnxt/bnxt_ethdev.c
+++ b/drivers/net/bnxt/bnxt_ethdev.c
@@ -3631,7 +3631,8 @@ bnxt_rx_descriptor_status_op(void *rx_queue, uint16_t
offset)
case CMPL_BASE_TYPE_RX_L2:
case CMPL_BASE_TYPE_RX_L2_V2:
if (desc == offset) {
- cons = rxcmp->opaque;
+ cons = RING_IDX(rxr->rx_ring_struct,
+ rxcmp->opaque);
if (rxr->rx_buf_ring[cons])
return RTE_ETH_RX_DESC_DONE;
else
diff --git a/drivers/net/bnxt/bnxt_hwrm.c b/drivers/net/bnxt/bnxt_hwrm.c
index 0143da8789..aae50c1fea 100644
--- a/drivers/net/bnxt/bnxt_hwrm.c
+++ b/drivers/net/bnxt/bnxt_hwrm.c
@@ -6242,7 +6242,8 @@ static int bnxt_hwrm_func_vf_vnic_query(struct bnxt *bp,
uint16_t vf,
}
rc = bnxt_hwrm_send_message(bp, &req, sizeof(req), BNXT_USE_CHIMP_MB);
HWRM_CHECK_RESULT();
- rc = rte_le_to_cpu_32(resp->vnic_id_cnt);
+ rc = RTE_MIN(rte_le_to_cpu_32(resp->vnic_id_cnt),
+ (uint32_t)bp->pf->total_vnics);
HWRM_UNLOCK();
diff --git a/drivers/net/bnxt/bnxt_rxr.c b/drivers/net/bnxt/bnxt_rxr.c
index 87640eaa79..cd4e93bdb3 100644
--- a/drivers/net/bnxt/bnxt_rxr.c
+++ b/drivers/net/bnxt/bnxt_rxr.c
@@ -1164,7 +1164,15 @@ static int bnxt_rx_pkt(struct rte_mbuf **rx_pkt,
}
tpa_info = &rxr->tpa_info[agg_id];
- RTE_ASSERT(tpa_info->agg_count < 16);
+ if (unlikely(tpa_info->agg_count >= TPA_MAX_NUM_SEGS)) {
+ PMD_DRV_LOG_LINE(ERR,
+ "TPA abuf: agg_count %u exceeds max
%u",
+ tpa_info->agg_count, TPA_MAX_NUM_SEGS);
+ tpa_info->agg_count = 0;
+ bnxt_sched_ring_reset(rxq);
+ rc = -EINVAL;
+ goto next_rx;
+ }
tpa_info->agg_arr[tpa_info->agg_count++] = *rx_agg;
rc = -EINVAL; /* Continue w/o new mbuf */
goto next_rx;
--
2.47.3
