patch 'net/bnxt/tf_core: fix out-of-bounds read in TCAM get' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 10/29/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/fc3378f527fd8fb62fe66d8a36bfa5cc9227fca8

Thanks.

Luca Boccassi

---
>From fc3378f527fd8fb62fe66d8a36bfa5cc9227fca8 Mon Sep 17 00:00:00 2001
From: Farah Smith <farah.smith at broadcom.com>
Date: Mon, 5 Oct 2026 10:16:55 -0500
Subject: [PATCH] net/bnxt/tf_core: fix out-of-bounds read in TCAM get

[ upstream commit d743f666ffbbd7bc13204655807b71710278c550 ]

A missing return after a buffer size check allowed execution to fall
through into memcpy calls using firmware-controlled lengths, causing
an out-of-bounds read from the response buffer and potential overflow
of the caller's key, mask, and remap buffers.

Fix by returning immediately on error before any data is copied out.

Also validate that firmware-reported sizes are consistent with the
fixed-size response data array before copying, and ensure firmware
response sizes are converted to host byte order before use. Cast
result_size to size_t in the new bounds check to match key_size and
avoid a -Wsign-compare warning against the size_t from sizeof().

Fixes: 80317ff6adfd ("net/bnxt/tf_core: support Thor2")

Signed-off-by: Farah Smith <farah.smith at broadcom.com>
Signed-off-by: Shahaji Bhosle <shahaji.bhosle at broadcom.com>
Signed-off-by: Manish Kurup <manish.kurup at broadcom.com>
---
 drivers/net/bnxt/tf_core/v3/tfc_msg.c | 28 ++++++++++++++++++---------
 1 file changed, 19 insertions(+), 9 deletions(-)

diff --git a/drivers/net/bnxt/tf_core/v3/tfc_msg.c b/drivers/net/bnxt/tf_core/v3/tfc_msg.c
index ef647072336..898ba94d85d 100644
--- a/drivers/net/bnxt/tf_core/v3/tfc_msg.c
+++ b/drivers/net/bnxt/tf_core/v3/tfc_msg.c
@@ -1049,18 +1049,28 @@ tfc_msg_tcam_get(struct tfc *tfcp, uint16_t fid, uint16_t sid,
 	rc = bnxt_hwrm_tf_message_direct(bp, false, HWRM_TFC_TCAM_GET,
 					 &req, sizeof(req), &resp, sizeof(resp));
 
-	if (rc ||
-	    *key_size < rte_le_to_cpu_16(resp.key_size) ||
+	if (rc)
+		return rc;
+
+	if ((size_t)rte_le_to_cpu_16(resp.key_size) * 2 +
+	    (size_t)rte_le_to_cpu_16(resp.result_size) > sizeof(resp.dev_data)) {
+		rc = -EINVAL;
+		PMD_DRV_LOG_LINE(ERR, "%s: FW sizes exceed TCAM bounds, rc:%d",
+				 __func__, rc);
+		return rc;
+	}
+	if (*key_size < rte_le_to_cpu_16(resp.key_size) ||
 	    *remap_size < rte_le_to_cpu_16(resp.result_size)) {
-		PMD_DRV_LOG_LINE(ERR, "Key buffer is too small, rc:%s",
-				 strerror(EINVAL));
 		rc = -EINVAL;
+		PMD_DRV_LOG_LINE(ERR, "%s: Caller buffer too small, rc:%d",
+				 __func__, rc);
+		return rc;
 	}
-	*key_size = resp.key_size;
-	*remap_size = resp.result_size;
-	memcpy(key, &resp.dev_data[0], resp.key_size);
-	memcpy(mask, &resp.dev_data[resp.key_size], resp.key_size);
-	memcpy(remap, &resp.dev_data[resp.key_size * 2], resp.result_size);
+	*key_size = rte_le_to_cpu_16(resp.key_size);
+	*remap_size = rte_le_to_cpu_16(resp.result_size);
+	memcpy(key, &resp.dev_data[0], *key_size);
+	memcpy(mask, &resp.dev_data[*key_size], *key_size);
+	memcpy(remap, &resp.dev_data[*key_size * 2], *remap_size);
 
 	return rc;
 }
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-10-27 11:44:00.317860481 +0000
+++ 0172-net-bnxt-tf_core-fix-out-of-bounds-read-in-TCAM-get.patch	2026-10-27 11:43:53.754066877 +0000
@@ -1 +1 @@
-From d743f666ffbbd7bc13204655807b71710278c550 Mon Sep 17 00:00:00 2001
+From fc3378f527fd8fb62fe66d8a36bfa5cc9227fca8 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit d743f666ffbbd7bc13204655807b71710278c550 ]
+
@@ -20 +21,0 @@
-Cc: stable at dpdk.org
@@ -30 +31 @@
-index cf72d09184..df11910dc3 100644
+index ef647072336..898ba94d85d 100644
@@ -33 +34 @@
-@@ -1154,18 +1154,28 @@ tfc_msg_tcam_get(struct tfc *tfcp, uint16_t fid, uint16_t sid,
+@@ -1049,18 +1049,28 @@ tfc_msg_tcam_get(struct tfc *tfcp, uint16_t fid, uint16_t sid,