[PATCH v3 0/5] net/bnxt: fix flow, Rx and naming bounds issues

[Mohammad Shuab Siddique]

From: Mohammad Shuab Siddique <mohammad-shuab.siddique at broadcom.com>

This series fixes five independent out-of-bounds issues in flow,
Rx-datapath and naming code in the bnxt PMD:

 - two stack-allocated variable-length arrays in flow-stats sizing
   that risked stack exhaustion,
 - a TPA aggregation ID read from a completion and used to index
   rxr->tpa_info[] without a bounds check,
 - sprintf() calls into fixed-size buffers with no bound on the
   formatted string length,
 - a caller-supplied MAC pool index used before being validated
   against bp->max_vnics, and
 - a firmware-supplied Rx completion opaque value used unmasked as
   an rx_buf_ring[] index, an aggregation-segment count guarded only
   by a release-mode-compiled-out RTE_ASSERT, and an unclamped VF
   VNIC-count from firmware.

Each patch is independently bisectable and was validated with a
scoped net/bnxt build (and, for split points, an intermediate-commit
build) in addition to the full compliance gate.

v3:
* Patch 3/5 ("harden sprintf bounds for device memory names"):
  dropped check_snprintf_rc() and the early-return paths on the CFA
  pair_name sites entirely -- Stephen Hemminger noted the rc < 0
  branch is unreachable and plain snprintf() is enough. See that
  patch's own changelog.
* Patch 4/5: retitled from "fix bounds in MAC pool index and flow
  parsing" to "fix bounds in MAC address pool index" and dropped the
  flow-parsing half entirely -- Stephen Hemminger pointed out
  rte_flow patterns/actions are always END-terminated by API
  contract, so that bound guarded nothing reachable. Also reordered
  the remaining fix to check pool-vs-max_vnics before dev_started.
  See that patch's own changelog.
* Patches 1/5, 2/5 and 5/5 are unchanged from v2.
v2:
* Patch 2/5 ("fix bounds on TPA aggregation ID from completions"):
  corrected its Fixes: tag SHA1s to the full 12-character form, and
  fixed a real bug an AI-review pass caught -- the legacy (non-Thor)
  TPA end path's new bounds-check-failure branch wasn't draining
  pending aggregation-buffer completions before returning, unlike
  the sibling in_reset early return right above it, which could
  desync the CQ consumer index.
* Patch 3/5: fixed a real bug an AI-review pass caught --
  bnxt_hwrm_ver_get()'s new early return on a snprintf failure also
  skipped HWRM_UNLOCK(), which would leak bp->hwrm_lock and deadlock
  every later HWRM call.
* Patch 4/5: fixed both Fixes: tag SHA1s to the full 12-character
  form.
* Patch 5/5: fixed all three Fixes: tag SHA1s to the full
  12-character form.
* Patch 1/5 is unchanged from v1.

Chenna Arnoori (1):
  net/bnxt: fix bounds in MAC address pool index

Joseph Wong (1):
  net/bnxt: fix stack exhaustion in flow stats

Keegan Freyhof (1):
  net/bnxt: harden sprintf bounds for device memory names

Kishore Padmanabha (1):
  net/bnxt: fix TPA agg Rx descriptor and VNIC query bounds

Mohammad Shuab Siddique (1):
  net/bnxt: validate TPA aggregation ID from completions

 drivers/net/bnxt/bnxt.h        |  1 +
 drivers/net/bnxt/bnxt_ethdev.c | 28 +++++++++-------
 drivers/net/bnxt/bnxt_flow.c   |  1 +
 drivers/net/bnxt/bnxt_hwrm.c   | 13 ++++----
 drivers/net/bnxt/bnxt_rxr.c    | 58 +++++++++++++++++++++++++++-------
 drivers/net/bnxt/bnxt_stats.c  | 23 +++++---------
 6 files changed, 80 insertions(+), 44 deletions(-)

--
2.47.3