From: Mohammad Shuab Siddique <[email protected]>
This series fixes five independent out-of-bounds issues in flow,
Rx-datapath and naming code in the bnxt PMD:
- two stack-allocated variable-length arrays in flow-stats sizing
that risked stack exhaustion,
- a TPA aggregation ID read from a completion and used to index
rxr->tpa_info[] without a bounds check,
- three separate sprintf() calls into fixed-size buffers with no
bound on the formatted string length, plus four related bugs
(a leak, a stale flag, and two locks left held) introduced by
this change's own new early-return paths and fixed here,
- a caller-supplied MAC pool index used before being validated
against bp->max_vnics, and an unbounded flow item/action skip
loop that could walk off the end of the pattern array, and
- a firmware-supplied Rx completion opaque value used unmasked as
an rx_buf_ring[] index, an aggregation-segment count guarded only
by a release-mode-compiled-out RTE_ASSERT, and an unclamped VF
VNIC-count from firmware.
Each patch is independently bisectable and was validated with a
scoped net/bnxt build (and, for split points, an intermediate-commit
build) in addition to the full compliance gate.
v2:
* Patch 2/5 ("fix bounds on TPA aggregation ID from completions"):
corrected its Fixes: tag SHA1s to the full 12-character form, and
fixed a real bug an AI-review pass caught -- the legacy (non-Thor)
TPA end path's new bounds-check-failure branch wasn't draining
pending aggregation-buffer completions before returning, unlike
the sibling in_reset early return right above it, which could
desync the CQ consumer index. See that patch's own changelog.
* Patch 3/5 ("harden sprintf bounds for device memory names"): fixed
a real bug an AI-review pass caught -- bnxt_hwrm_ver_get()'s new
early return on a snprintf failure also skipped HWRM_UNLOCK(),
unlike this same function's other error exits and the sibling
cfa_pair_*() fixes in this same patch, which would leak
bp->hwrm_lock and deadlock every later HWRM call. See that patch's
own changelog.
* Patch 4/5 ("fix bounds in MAC pool index and flow parsing"): fixed
both Fixes: tag SHA1s to the full 12-character form.
* Patch 5/5 ("fix TPA agg Rx descriptor and VNIC query bounds"):
fixed all three Fixes: tag SHA1s to the full 12-character form.
Also addressed (no code change needed, see that patch's changelog)
a reviewer question about a possible leak in the agg_count-overflow
error path.
* Patch 1/5 is unchanged from v1.
Chenna Arnoori (1):
net/bnxt: fix bounds in MAC pool index and flow parsing
Joseph Wong (1):
net/bnxt: fix stack exhaustion in flow stats
Keegan Freyhof (1):
net/bnxt: harden sprintf bounds for device memory names
Kishore Padmanabha (1):
net/bnxt: fix TPA agg Rx descriptor and VNIC query bounds
Mohammad Shuab Siddique (1):
net/bnxt: fix bounds on TPA aggregation ID from completions
drivers/net/bnxt/bnxt.h | 15 +++++++
drivers/net/bnxt/bnxt_ethdev.c | 43 +++++++++++++-------
drivers/net/bnxt/bnxt_flow.c | 28 +++++++++----
drivers/net/bnxt/bnxt_hwrm.c | 75 ++++++++++++++++++++++++++---------
drivers/net/bnxt/bnxt_rxr.c | 58 +++++++++++++++++++++-------
drivers/net/bnxt/bnxt_stats.c | 18 ++++-----
6 files changed, 175 insertions(+), 62 deletions(-)
--
2.47.3
