From: Mohammad Shuab Siddique <[email protected]> This series fixes five independent out-of-bounds and memory-leak issues in VF- and firmware-facing control-path code in the bnxt PMD:
- an unvalidated, firmware-controlled VF ID used to index bp->pf->vf_info[] before range-checking it, - firmware-reported ring-group/L2-context counts that were not clamped before being cast down or summed, - a use-after-free in the VNIC filter list walk during cleanup (STAILQ_FOREACH() dereferencing a node this loop had already freed), - a memory leak on the VF VNIC query error path, and - a memory leak on the VF info allocation error path. Each patch is independently bisectable and was validated with a scoped net/bnxt build (and, for split points, an intermediate-commit build) in addition to the full compliance gate. Joseph Wong (3): net/bnxt: add VF ID boundary check before usage net/bnxt: fix bounds on firmware-reported resource counts net/bnxt: fix VF info alloc error path memory leak Kishore Padmanabha (1): net/bnxt: fix memory leak in VF VNIC query error path Mohammad Shuab Siddique (1): net/bnxt: fix use-after-free in VNIC filter cleanup drivers/net/bnxt/bnxt.h | 3 +++ drivers/net/bnxt/bnxt_cpr.c | 25 ++++++++++++++----------- drivers/net/bnxt/bnxt_hwrm.c | 31 +++++++++++++++++++++---------- 3 files changed, 38 insertions(+), 21 deletions(-) -- 2.47.3
