patch 'net/bnxt: fix NVRAM directory integer overflow' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 10/29/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/5877a1f0b765dde7cb16665ceae1498f4f2de83c

Thanks.

Luca Boccassi

---
>From 5877a1f0b765dde7cb16665ceae1498f4f2de83c Mon Sep 17 00:00:00 2001
From: Joseph Wong <joseph.wong at broadcom.com>
Date: Thu, 28 May 2026 22:31:22 -0700
Subject: [PATCH] net/bnxt: fix NVRAM directory integer overflow

[ upstream commit b2c95eacbcdbe03b7cdae7133b1f3faba300f99b ]

Add bounds checking in bnxt_get_nvram_directory() to prevent a length
underflow when subtracting 2 from the input length, and an integer
overflow when calculating the required buffer length. Also enforce
firmware-supplied upper bounds on the directory entry count and entry
length, guarding against an undersized DMA buffer if firmware reports
implausible values, and use 64-bit arithmetic for the buffer size
calculation. The two returned values are each written back as a
single byte, so their upper bounds are UINT8_MAX, not larger values
that would let a firmware-reported value above 255 pass validation
and then silently truncate on the byte store.

Fixes: 19e6af01bb36 ("net/bnxt: support get/set EEPROM")

Signed-off-by: Joseph Wong <joseph.wong at broadcom.com>
Signed-off-by: Farah Smith <farah.smith at broadcom.com>
Signed-off-by: Mohammad Shuab Siddique <mohammad-shuab.siddique at broadcom.com>
---
 .mailmap                     |  1 +
 drivers/net/bnxt/bnxt_hwrm.c | 16 +++++++++++++++-
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/.mailmap b/.mailmap
index f6a14babc30..43e685a94ba 100644
--- a/.mailmap
+++ b/.mailmap
@@ -778,6 +778,7 @@ Jørgen Østergaard Sloth <jorgen.sloth at xci.dk>
 Jörg Thalheim <joerg at thalheim.io>
 Joseph Richard <joseph.richard at windriver.com>
 Josh Hay <joshua.a.hay at intel.com>
+Joseph Wong <joseph.wong at broadcom.com>
 Josh Soref <jsoref at gmail.com>
 Joshua Hay <joshua.a.hay at intel.com>
 Joshua Washington <joshwash at google.com>
diff --git a/drivers/net/bnxt/bnxt_hwrm.c b/drivers/net/bnxt/bnxt_hwrm.c
index 8d0013ebefc..2cd7582be00 100644
--- a/drivers/net/bnxt/bnxt_hwrm.c
+++ b/drivers/net/bnxt/bnxt_hwrm.c
@@ -6015,6 +6015,9 @@ int bnxt_hwrm_nvm_get_dir_info(struct bnxt *bp, uint32_t *entries,
 	return rc;
 }
 
+#define BNXT_MAX_DIR_ENTRIES   UINT8_MAX
+#define BNXT_MAX_ENTRY_LENGTH  UINT8_MAX
+
 int bnxt_get_nvram_directory(struct bnxt *bp, uint32_t len, uint8_t *data)
 {
 	int rc;
@@ -6026,16 +6029,27 @@ int bnxt_get_nvram_directory(struct bnxt *bp, uint32_t len, uint8_t *data)
 	struct hwrm_nvm_get_dir_entries_input req = {0};
 	struct hwrm_nvm_get_dir_entries_output *resp = bp->hwrm_cmd_resp_addr;
 
+	if (len < 2)
+		return -EINVAL;
+
 	rc = bnxt_hwrm_nvm_get_dir_info(bp, &dir_entries, &entry_length);
 	if (rc != 0)
 		return rc;
 
+	if (dir_entries == 0 || dir_entries > BNXT_MAX_DIR_ENTRIES ||
+	    entry_length == 0 || entry_length > BNXT_MAX_ENTRY_LENGTH) {
+		PMD_DRV_LOG_LINE(ERR,
+			"Invalid dir info: entries=%u length=%u",
+			dir_entries, entry_length);
+		return -EINVAL;
+	}
+
 	*data++ = dir_entries;
 	*data++ = entry_length;
 	len -= 2;
 	memset(data, 0xff, len);
 
-	buflen = dir_entries * entry_length;
+	buflen = (size_t)dir_entries * entry_length;
 	buf = rte_malloc("nvm_dir", buflen, 0);
 	if (buf == NULL)
 		return -ENOMEM;
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-10-27 11:44:00.166174684 +0000
+++ 0168-net-bnxt-fix-NVRAM-directory-integer-overflow.patch	2026-10-27 11:43:53.750066753 +0000
@@ -1 +1 @@
-From b2c95eacbcdbe03b7cdae7133b1f3faba300f99b Mon Sep 17 00:00:00 2001
+From 5877a1f0b765dde7cb16665ceae1498f4f2de83c Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit b2c95eacbcdbe03b7cdae7133b1f3faba300f99b ]
+
@@ -18 +19,0 @@
-Cc: stable at dpdk.org
@@ -29 +30 @@
-index 67ff247224..b2fe3166d6 100644
+index f6a14babc30..43e685a94ba 100644
@@ -32,2 +33 @@
-@@ -820,6 +820,7 @@ Jonathan Tsai <jonathan1.tsai at intel.com>
- Joongi Kim <joongi at an.kaist.ac.kr>
+@@ -778,6 +778,7 @@ Jørgen Østergaard Sloth <jorgen.sloth at xci.dk>
@@ -35,0 +36 @@
+ Josh Hay <joshua.a.hay at intel.com>
@@ -41 +42 @@
-index 93fe754ced..df8cd14efb 100644
+index 8d0013ebefc..2cd7582be00 100644