[PATCH v2] net/bnxt: fix parent MAC lookup path handling

[Mohammad Shuab Siddique]

From: Dakota Sicher <dakota.sicher at broadcom.com>

ulp_pmd_get_mac_by_pci() builds sysfs paths with sprintf() into a
256 byte buffer from a PCI name and an interface name taken from
glob(). Use snprintf() and fail if the path is truncated.

The glob() result was also never released. Call globfree() on every
exit path once glob() has succeeded.

Fixes: 1993b267dbcb ("net/bnxt: cleanup ULP parser and mapper")
Cc: stable at dpdk.org

Signed-off-by: Dakota Sicher <dakota.sicher at broadcom.com>
Signed-off-by: Manish Kurup <manish.kurup at broadcom.com>
Signed-off-by: Mohammad Shuab Siddique <mohammad-shuab.siddique at broadcom.com>
---
v2:
 - Also free the glob() result on every exit path; it was never released
 - Drop the ulp_utils.h hunks, they are covered by the -Warray-bounds patch
 - New subject and body, Cc: stable added

 drivers/net/bnxt/tf_ulp/bnxt_tf_pmd_shim.c | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/drivers/net/bnxt/tf_ulp/bnxt_tf_pmd_shim.c b/drivers/net/bnxt/tf_ulp/bnxt_tf_pmd_shim.c
index bfd5f4b230e..81e335da592 100644
--- a/drivers/net/bnxt/tf_ulp/bnxt_tf_pmd_shim.c
+++ b/drivers/net/bnxt/tf_ulp/bnxt_tf_pmd_shim.c
@@ -140,30 +140,38 @@ static int32_t ulp_pmd_get_mac_by_pci(const char *pci_name, uint8_t *mac)
 	glob_t gres;
 	FILE *fp;
 	int32_t rc = -EINVAL;
+	int32_t pr;
 
 	memset(path, 0, sizeof(path));
-	sprintf(path, PARENT_PHY_INTF_PATH, pci_name);
-
+	pr = snprintf(path, sizeof(path), PARENT_PHY_INTF_PATH, pci_name);
+	if (unlikely((size_t)pr >= sizeof(path) || pr < 0)) {
+		BNXT_DRV_DBG(ERR, "Error writing path: %s", path);
+		return rc;
+	}
 	/* There can be only one, no more, no less */
 	if (glob(path, 0, glob_error_fn, &gres) == 0) {
 		if (gres.gl_pathc != 1)
-			return rc;
+			goto free_glob;
 
 		/* Replace the PCI address with interface name and get index */
 		intf_name = basename(gres.gl_pathv[0]);
-		sprintf(path, ULP_PRT_MAC_PATH, pci_name, intf_name);
+		pr = snprintf(path, sizeof(path), ULP_PRT_MAC_PATH, pci_name, intf_name);
+		if (unlikely((size_t)pr >= sizeof(path) || pr < 0)) {
+			BNXT_DRV_DBG(ERR, "Error writing path: %s", path);
+			goto free_glob;
+		}
 
 		fp = fopen(path, "r");
 		if (!fp) {
 			BNXT_DRV_DBG(ERR, "Error in getting bond mac address\n");
-			return rc;
+			goto free_glob;
 		}
 
 		memset(dev_str, 0, sizeof(dev_str));
 		if (fgets(dev_str, sizeof(dev_str), fp) == NULL) {
 			BNXT_DRV_DBG(ERR, "Error in reading %s\n", path);
 			fclose(fp);
-			return rc;
+			goto free_glob;
 		}
 
 		if (sscanf(dev_str, "%hhx:%hhx:%hhx:%hhx:%hhx:%hhx\n",
@@ -171,6 +179,8 @@ static int32_t ulp_pmd_get_mac_by_pci(const char *pci_name, uint8_t *mac)
 			   &mac[3], &mac[4], &mac[5]) == 6)
 			rc = 0;
 		fclose(fp);
+free_glob:
+		globfree(&gres);
 	}
 	return rc;
 }
-- 
2.47.3