https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=284073
--- Comment #27 from commit-h...@freebsd.org --- A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=3de231b4d956f7b9c22e31f75805030a417f7bf3 commit 3de231b4d956f7b9c22e31f75805030a417f7bf3 Author: Zhenlei Huang <z...@freebsd.org> AuthorDate: 2025-02-14 10:38:29 +0000 Commit: Zhenlei Huang <z...@freebsd.org> CommitDate: 2025-02-14 10:38:29 +0000 bnxt_en: Retrieve maximum of 128 APP TLVs It appears that the maximum number of APP TLVs supported by the hardware is 128 according to D45005. Well Daniel Porsch reported an issue PR284073 which shows that the number can exceed the limit, causing out of bound write to on-stack allocated variable app[128] and the kernel panics. Limit to 128 while retrieving APP TLVs. PR: 284073 Reviewed by: markj Tested by: Daniel Porsch <daniel.por...@loopia.se> Fixes: 35b53f8c989f bnxt_en: Add PFC, ETS & App TLVs protocols support MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D48589 sys/dev/bnxt/bnxt_en/bnxt.h | 3 ++- sys/dev/bnxt/bnxt_en/bnxt_dcb.c | 17 ++++++++++------- sys/dev/bnxt/bnxt_en/bnxt_mgmt.c | 1 + sys/dev/bnxt/bnxt_en/bnxt_sysctl.c | 2 +- 4 files changed, 14 insertions(+), 9 deletions(-) -- You are receiving this mail because: You are the assignee for the bug.
