patch 'net/bnxt/tf_core: validate TCAM entry get response' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 11/07/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/3e88d106a47b67cad56273023045f3cf484e8adf

Thanks.

Luca Boccassi

---
>From 3e88d106a47b67cad56273023045f3cf484e8adf Mon Sep 17 00:00:00 2001
From: Manish Kurup <manish.kurup at broadcom.com>
Date: Tue, 20 Oct 2026 01:59:49 -0500
Subject: [PATCH] net/bnxt/tf_core: validate TCAM entry get response

[ upstream commit 5fc0da2606c0ef4dcd361f1b4829fad5834aa7a7 ]

tf_msg_tcam_entry_get() copies the TCAM key, mask and result out of
the firmware response using the key_size, result_offset and
result_size values returned in the response, without checking them
against the size of the dev_data[] array they index. The mask is
read from dev_data[key_size] for key_size bytes and the result from
dev_data[result_offset] for result_size bytes, so a bad value
makes the copy read past the end of the 272 byte array in the
response on the stack.

Reject the response with -EINVAL if the key and mask (2 * key_size)
or the result (result_offset + result_size) do not fit in dev_data[].

Fixes: a9597be79f66 ("net/bnxt: support L2 context TCAM operations")

Signed-off-by: Manish Kurup <manish.kurup at broadcom.com>
---
 drivers/net/bnxt/tf_core/tf_msg.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/net/bnxt/tf_core/tf_msg.c b/drivers/net/bnxt/tf_core/tf_msg.c
index 827f94dde61..dab3d2c323f 100644
--- a/drivers/net/bnxt/tf_core/tf_msg.c
+++ b/drivers/net/bnxt/tf_core/tf_msg.c
@@ -1243,6 +1243,16 @@ tf_msg_tcam_entry_get(struct tf *tfp,
 			    strerror(-rc));
 		return rc;
 	}
+	if (resp.key_size * 2 > sizeof(resp.dev_data) ||
+	    resp.result_offset + resp.result_size > sizeof(resp.dev_data)) {
+		rc = -EINVAL;
+		TFP_DRV_LOG(ERR,
+			    "%s: FW data out of bounds key_size(%d) result_offset(%d) result_size(%d), rc:%s\n",
+			    tf_dir_2_str(parms->dir), resp.key_size,
+			    resp.result_offset, resp.result_size,
+			    strerror(-rc));
+		return rc;
+	}
 	parms->key_size = resp.key_size;
 	parms->result_size = resp.result_size;
 	tfp_memcpy(parms->key, resp.dev_data, resp.key_size);
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-11-05 16:42:46.061641973 +0000
+++ 0027-net-bnxt-tf_core-validate-TCAM-entry-get-response.patch	2026-11-05 16:42:44.921060786 +0000
@@ -1 +1 @@
-From 5fc0da2606c0ef4dcd361f1b4829fad5834aa7a7 Mon Sep 17 00:00:00 2001
+From 3e88d106a47b67cad56273023045f3cf484e8adf Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 5fc0da2606c0ef4dcd361f1b4829fad5834aa7a7 ]
+
@@ -19 +20,0 @@
-Cc: stable at dpdk.org
@@ -27 +28 @@
-index aab8d05d81..c345d0a7ce 100644
+index 827f94dde61..dab3d2c323f 100644