patch 'net/bnxt/tf_core: prevent buffer overflow in messages' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 11/07/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/f7cdf489f00fb0181bccf5114e18d3fab349af9e

Thanks.

Luca Boccassi

---
>From f7cdf489f00fb0181bccf5114e18d3fab349af9e Mon Sep 17 00:00:00 2001
From: Stephen Hemminger <stephen at networkplumber.org>
Date: Tue, 27 Oct 2026 20:53:53 -0700
Subject: [PATCH] net/bnxt/tf_core: prevent buffer overflow in messages

[ upstream commit 8be41609183e6da0ca2bc02b29fe442926232bf0 ]

LTO build with -Werror reports stack overflows in tf_msg.c:

  In function 'tf_global_cfg_set':
  rte_memcpy.h:91:9: error: writing 16 bytes into a region of size 8
  tf_msg.c:1574:45: note: at offset 48 into destination object 'req'
  of size 56

  In function 'tf_msg_set_if_tbl_entry':
  rte_memcpy.h:105:9: error: writing 32 bytes into a region of size 0
  tf_msg.c:1813:41: note: at offset 136 into destination object 'req'
  of size 128

tf_msg_set_global_cfg() limits config_sz_in_bytes to 16, but
req.data and req.mask are each 8 bytes. A config larger than 8 bytes
overruns data into mask, and the mask copy runs off the end of req.

tf_msg_set_if_tbl_entry() has no check at all. data_sz_in_bytes is a
uint16_t copied into the 88 byte req.data. The ULP mapper fills it
from a blob of up to 128 bytes.

Check both against sizeof() of the destination, as the matching get
functions already do.

Fixes: 98487d729b4a ("net/bnxt: cleanup and refactor session management")

Signed-off-by: Stephen Hemminger <stephen at networkplumber.org>
Acked-by: Kishore Padmanabha <kishore.padmanabha at broadcom.com>
---
 drivers/net/bnxt/tf_core/tf_msg.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/bnxt/tf_core/tf_msg.c b/drivers/net/bnxt/tf_core/tf_msg.c
index dab3d2c323f..94117937391 100644
--- a/drivers/net/bnxt/tf_core/tf_msg.c
+++ b/drivers/net/bnxt/tf_core/tf_msg.c
@@ -23,7 +23,6 @@
  * means we have to manually sync hwrm with these defines if the
  * tf.yaml changes.
  */
-#define TF_MSG_SET_GLOBAL_CFG_DATA_SIZE  16
 #define TF_MSG_EM_INSERT_KEY_SIZE        64
 #define TF_MSG_EM_INSERT_RECORD_SIZE     96
 #define TF_MSG_TBL_TYPE_SET_DATA_SIZE    88
@@ -1628,7 +1627,7 @@ tf_msg_set_global_cfg(struct tf *tfp,
 	req.offset = tfp_cpu_to_le_32(params->offset);
 
 	/* Check for data size conformity */
-	if (params->config_sz_in_bytes > TF_MSG_SET_GLOBAL_CFG_DATA_SIZE) {
+	if (params->config_sz_in_bytes > sizeof(req.data)) {
 		rc = -EINVAL;
 		TFP_DRV_LOG(ERR,
 			    "%s: Invalid parameters for msg type, rc:%s\n",
@@ -1826,6 +1825,9 @@ tf_msg_set_if_tbl_entry(struct tf *tfp,
 	struct tf_dev_info *dev;
 	struct tf_session *tfs;
 
+	if (params->data_sz_in_bytes > sizeof(req.data))
+		return -EINVAL;
+
 	/* Retrieve the session information */
 	rc = tf_session_get_session(tfp, &tfs);
 	if (rc) {
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-11-05 16:42:46.403831386 +0000
+++ 0036-net-bnxt-tf_core-prevent-buffer-overflow-in-messages.patch	2026-11-05 16:42:44.937061264 +0000
@@ -1 +1 @@
-From 8be41609183e6da0ca2bc02b29fe442926232bf0 Mon Sep 17 00:00:00 2001
+From f7cdf489f00fb0181bccf5114e18d3fab349af9e Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 8be41609183e6da0ca2bc02b29fe442926232bf0 ]
+
@@ -30 +31,0 @@
-Cc: stable at dpdk.org
@@ -39 +40 @@
-index c345d0a7ce..29a64deaf4 100644
+index dab3d2c323f..94117937391 100644