[PATCH v3 0/5] net/bnxt: fix VF and firmware-facing bounds/leak issues

[Mohammad Shuab Siddique]

From: Mohammad Shuab Siddique <mohammad-shuab.siddique at broadcom.com>

This series fixes five independent out-of-bounds and memory-leak
issues in VF- and firmware-facing control-path code in the bnxt PMD:

 - an unvalidated, firmware-controlled VF ID used to index
   bp->pf->vf_info[] before range-checking it,
 - firmware-reported ring-group/L2-context counts that were not
   clamped before being cast down or summed,
 - a VNIC filter list walk during cleanup that stopped after the
   first entry (STAILQ_FOREACH()'s advance step reading a next
   pointer this same loop had already zeroed via memset()),
 - a memory leak on the VF VNIC query error path, and
 - a memory leak on the VF info allocation error path.

Each patch is independently bisectable and was validated with a
scoped net/bnxt build (and, for split points, an intermediate-commit
build) in addition to the full compliance gate.

v3:
* Patch 2/5 ("fix bounds on firmware-reported resource counts"):
  removed the defense-in-depth clamp v2 added to
  bnxt_hwrm_func_resc_qcaps() and fixed the actual bug Stephen
  Hemminger found instead -- that function read a uint16_t firmware
  field with rte_le_to_cpu_32(). See that patch's own changelog.
* Patch 3/5: retitled from "fix use-after-free in VNIC filter
  cleanup" to "fix VNIC filter list walk stopping early" and
  rewrote its description -- Stephen Hemminger pointed out
  bnxt_free_filter() frees nothing, so the original description was
  wrong; the real bug is the early-termination leak. Tried Stephen's
  suggested STAILQ_FOREACH_SAFE(), but it isn't portable to this
  build (no STAILQ _SAFE variant in glibc's sys/queue.h or in DPDK's
  own RTE_TAILQ_FOREACH_SAFE() wrapper); kept v2's
  STAILQ_FIRST()/STAILQ_REMOVE_HEAD() loop, which is equivalent for
  this always-drain-the-head pattern. No code change.
* Patches 1/5, 4/5 and 5/5 are unchanged from v2.
v2:
* Patch 2/5 and patch 5/5 had their Fixes: tag SHA1s corrected to the
  full 12-character form per checkpatch's BAD_FIXES_TAG warning. No
  functional/code changes anywhere in this series -- patches 1/5,
  3/5 and 4/5 were unchanged from v1.

Joseph Wong (3):
  net/bnxt: add VF ID boundary check before usage
  net/bnxt: fix bounds on firmware-reported resource counts
  net/bnxt: fix VF info alloc error path memory leak

Kishore Padmanabha (1):
  net/bnxt: fix memory leak in VF VNIC query error path

Mohammad Shuab Siddique (1):
  net/bnxt: fix VNIC filter list walk stopping early

 drivers/net/bnxt/bnxt.h      |  3 +++
 drivers/net/bnxt/bnxt_cpr.c  | 27 ++++++++++++++-------------
 drivers/net/bnxt/bnxt_hwrm.c | 31 ++++++++++++++++++++-----------
 3 files changed, 37 insertions(+), 24 deletions(-)

--
2.47.3