From: Mohammad Shuab Siddique <[email protected]> This series fixes five independent out-of-bounds issues in flow, Rx-datapath and naming code in the bnxt PMD:
- two stack-allocated variable-length arrays in flow-stats sizing that risked stack exhaustion, - a TPA aggregation ID read from a completion and used to index rxr->tpa_info[] without a bounds check, - three separate sprintf() calls into fixed-size buffers with no bound on the formatted string length, plus three related bugs (a leak, a stale flag, and a lock left held) introduced by this change's own new early-return paths and fixed here, - a caller-supplied MAC pool index used before being validated against bp->max_vnics, and an unbounded flow item/action skip loop that could walk off the end of the pattern array, and - a firmware-supplied Rx completion opaque value used unmasked as an rx_buf_ring[] index, an aggregation-segment count guarded only by a release-mode-compiled-out RTE_ASSERT, and an unclamped VF VNIC-count from firmware. Each patch is independently bisectable and was validated with a scoped net/bnxt build (and, for split points, an intermediate-commit build) in addition to the full compliance gate. Chenna Arnoori (1): net/bnxt: fix bounds in MAC pool index and flow parsing Joseph Wong (1): net/bnxt: fix stack exhaustion in flow stats Keegan Freyhof (1): net/bnxt: harden sprintf bounds for device memory names Kishore Padmanabha (1): net/bnxt: fix TPA agg Rx descriptor and VNIC query bounds Mohammad Shuab Siddique (1): net/bnxt: fix bounds on TPA aggregation ID from completions drivers/net/bnxt/bnxt.h | 15 +++++++ drivers/net/bnxt/bnxt_ethdev.c | 43 +++++++++++++------- drivers/net/bnxt/bnxt_flow.c | 28 +++++++++---- drivers/net/bnxt/bnxt_hwrm.c | 74 +++++++++++++++++++++++++--------- drivers/net/bnxt/bnxt_rxr.c | 57 ++++++++++++++++++++------ drivers/net/bnxt/bnxt_stats.c | 18 ++++----- 6 files changed, 173 insertions(+), 62 deletions(-) -- 2.47.3
