On Sun, 20 Sep 2026 20:24:19 -0600 Mohammad Shuab Siddique <[email protected]> wrote:
> From: Chenna Arnoori <[email protected]> > > Two independent out-of-bounds issues in the driver: > > - bnxt_mac_addr_add_op() indexed bp->vnic_info[pool] with a > caller-supplied pool before validating it against bp->max_vnics, and > before checking bp->vnic_info was even allocated yet (it is NULL > until the port is started). The existing "if (!vnic)" check was > always false, since vnic held the address of an array element and > is never NULL. Reorder to check dev_started/vnic_info first, then > bounds-check pool against max_vnics before indexing. > > - bnxt_flow_non_void_item()/bnxt_flow_non_void_action() looped > unconditionally until a non-VOID item/action was found, walking off > the end of a pattern/actions array that lacked a terminating END > item. Bound the skip loop and stop advancing once the limit is hit. > > Fixes: 51fafb89a9a0 ("net/bnxt: get rid of ff pools and use VNIC info array") > Fixes: 5c1171c97216 ("net/bnxt: refactor filter/flow") > Cc: [email protected] > > Signed-off-by: Chenna Arnoori <[email protected]> > Signed-off-by: Mohammad Shuab Siddique <[email protected]> > --- [PATCH v2 4/5] net/bnxt: fix bounds in MAC pool index and flow parsing Warning: the bounded VOID skip does not bound the walk. The outer loops in bnxt_filter_type_check() and bnxt_validate_and_parse_flow_type() run while type != END. After 256 VOIDs the helper returns a VOID item, and the loop calls it again at item + 1. A pattern without END is still walked off the end, and non-VOID items are never counted. The rte_flow API requires the END terminator. Drop this half of the patch. The added "if (!cur) return NULL" paths return a value that no caller checks. Warning: in bnxt_mac_addr_add_op() the pool bounds check comes after the dev_started early return. An invalid pool added while the port is stopped returns 0, is recorded in mac_pool_sel, and then fails later in bnxt_restore_mac_filters() at dev_start. Validate pool against bp->max_vnics before the dev_started test. The bp->vnic_info == NULL test after dev_started is dead code.
