<div dir="ltr"><div dir="ltr"> </div> <div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Tue, Oct 27, 2026 at 11:53 PM Stephen Hemminger <<a href="mailto:stephen@networkplumber.org">stephen@networkplumber.org</a>> wrote: </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">LTO build with -Werror reports stack overflows in tf_msg.c: In function 'tf_global_cfg_set': rte_memcpy.h:91:9: error: writing 16 bytes into a region of size 8 tf_msg.c:1574:45: note: at offset 48 into destination object 'req' of size 56 In function 'tf_msg_set_if_tbl_entry': rte_memcpy.h:105:9: error: writing 32 bytes into a region of size 0 tf_msg.c:1813:41: note: at offset 136 into destination object 'req' of size 128 tf_msg_set_global_cfg() limits config_sz_in_bytes to 16, but req.data and req.mask are each 8 bytes. A config larger than 8 bytes overruns data into mask, and the mask copy runs off the end of req. tf_msg_set_if_tbl_entry() has no check at all. data_sz_in_bytes is a uint16_t copied into the 88 byte req.data. The ULP mapper fills it from a blob of up to 128 bytes. Check both against sizeof() of the destination, as the matching get functions already do. Fixes: 98487d729b4a ("net/bnxt: cleanup and refactor session management") Cc: <a href="mailto:stable@dpdk.org" target="_blank">stable@dpdk.org</a> Signed-off-by: Stephen Hemminger <<a href="mailto:stephen@networkplumber.org" target="_blank">stephen@networkplumber.org</a>> </blockquote><div>Acked-by: Kishore Padmanabha <<a href="mailto:kishore.padmanabha@broadcom.com">kishore.padmanabha@broadcom.com</a>> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> --- drivers/net/bnxt/tf_core/tf_msg.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/bnxt/tf_core/tf_msg.c b/drivers/net/bnxt/tf_core/tf_msg.c index aab8d05d81..ab03afaabd 100644 --- a/drivers/net/bnxt/tf_core/tf_msg.c +++ b/drivers/net/bnxt/tf_core/tf_msg.c @@ -23,7 +23,6 @@ * means we have to manually sync hwrm with these defines if the * tf.yaml changes. */ -#define TF_MSG_SET_GLOBAL_CFG_DATA_SIZE 16 #define TF_MSG_EM_INSERT_KEY_SIZE 64 #define TF_MSG_EM_INSERT_RECORD_SIZE 96 #define TF_MSG_TBL_TYPE_SET_DATA_SIZE 88 @@ -1618,7 +1617,7 @@ tf_msg_set_global_cfg(struct tf *tfp, req.offset = tfp_cpu_to_le_32(params->offset); /* Check for data size conformity */ - if (params->config_sz_in_bytes > TF_MSG_SET_GLOBAL_CFG_DATA_SIZE) { + if (params->config_sz_in_bytes > sizeof(req.data)) { rc = -EINVAL; TFP_DRV_LOG(ERR, "%s: Invalid parameters for msg type, rc:%s\n", @@ -1816,6 +1815,9 @@ tf_msg_set_if_tbl_entry(struct tf *tfp, struct tf_dev_info *dev; struct tf_session *tfs; + if (params->data_sz_in_bytes > sizeof(req.data)) + return -EINVAL; + /* Retrieve the session information */ rc = tf_session_get_session(tfp, &tfs); if (rc) { -- 2.53.0 </blockquote></div></div>