[PATCH 5/5] net/bnxt: fix TPA agg Rx descriptor and VNIC query bounds

[Mohammad Shuab Siddique]

From: Kishore Padmanabha <kishore.padmanabha at broadcom.com>

Three independent out-of-bounds issues:

- bnxt_rx_pkt() incremented tpa_info->agg_count and indexed
  tpa_info->agg_arr[] with only an RTE_ASSERT (compiled out in release
  builds) guarding the array bound, allowing an out-of-bounds write if
  firmware sent more aggregation segments than TPA_MAX_NUM_SEGS.

- bnxt_rx_descriptor_status_op() used the firmware-supplied completion
  opaque value directly as an rx_buf_ring[] index without masking it to
  the ring size first.

- bnxt_hwrm_func_vf_vnic_query() returned the firmware-reported
  vnic_id_cnt unclamped; a value exceeding bp->pf->total_vnics would
  cause the caller to iterate past the end of its VNIC ID buffer.

Fixes: b150a7e7ee ("net/bnxt: support LRO on Thor adapters")
Fixes: 0fe613bb87 ("net/bnxt: support Rx descriptor status")
Fixes: cbcd375d37 ("net/bnxt: fix HWRM macros and locking")
Cc: stable at dpdk.org

Signed-off-by: Kishore Padmanabha <kishore.padmanabha at broadcom.com>
Signed-off-by: Mohammad Shuab Siddique <mohammad-shuab.siddique at broadcom.com>
---
 drivers/net/bnxt/bnxt_ethdev.c |  3 ++-
 drivers/net/bnxt/bnxt_hwrm.c   |  3 ++-
 drivers/net/bnxt/bnxt_rxr.c    | 10 +++++++++-
 3 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/drivers/net/bnxt/bnxt_ethdev.c b/drivers/net/bnxt/bnxt_ethdev.c
index db9b49238a..d21ebac0c2 100644
--- a/drivers/net/bnxt/bnxt_ethdev.c
+++ b/drivers/net/bnxt/bnxt_ethdev.c
@@ -3631,7 +3631,8 @@ bnxt_rx_descriptor_status_op(void *rx_queue, uint16_t offset)
 		case CMPL_BASE_TYPE_RX_L2:
 		case CMPL_BASE_TYPE_RX_L2_V2:
 			if (desc == offset) {
-				cons = rxcmp->opaque;
+				cons = RING_IDX(rxr->rx_ring_struct,
+						 rxcmp->opaque);
 				if (rxr->rx_buf_ring[cons])
 					return RTE_ETH_RX_DESC_DONE;
 				else
diff --git a/drivers/net/bnxt/bnxt_hwrm.c b/drivers/net/bnxt/bnxt_hwrm.c
index 0143da8789..aae50c1fea 100644
--- a/drivers/net/bnxt/bnxt_hwrm.c
+++ b/drivers/net/bnxt/bnxt_hwrm.c
@@ -6242,7 +6242,8 @@ static int bnxt_hwrm_func_vf_vnic_query(struct bnxt *bp, uint16_t vf,
 	}
 	rc = bnxt_hwrm_send_message(bp, &req, sizeof(req), BNXT_USE_CHIMP_MB);
 	HWRM_CHECK_RESULT();
-	rc = rte_le_to_cpu_32(resp->vnic_id_cnt);
+	rc = RTE_MIN(rte_le_to_cpu_32(resp->vnic_id_cnt),
+		     (uint32_t)bp->pf->total_vnics);
 
 	HWRM_UNLOCK();
 
diff --git a/drivers/net/bnxt/bnxt_rxr.c b/drivers/net/bnxt/bnxt_rxr.c
index 87640eaa79..cd4e93bdb3 100644
--- a/drivers/net/bnxt/bnxt_rxr.c
+++ b/drivers/net/bnxt/bnxt_rxr.c
@@ -1164,7 +1164,15 @@ static int bnxt_rx_pkt(struct rte_mbuf **rx_pkt,
 		}
 
 		tpa_info = &rxr->tpa_info[agg_id];
-		RTE_ASSERT(tpa_info->agg_count < 16);
+		if (unlikely(tpa_info->agg_count >= TPA_MAX_NUM_SEGS)) {
+			PMD_DRV_LOG_LINE(ERR,
+					 "TPA abuf: agg_count %u exceeds max %u",
+					 tpa_info->agg_count, TPA_MAX_NUM_SEGS);
+			tpa_info->agg_count = 0;
+			bnxt_sched_ring_reset(rxq);
+			rc = -EINVAL;
+			goto next_rx;
+		}
 		tpa_info->agg_arr[tpa_info->agg_count++] = *rx_agg;
 		rc = -EINVAL; /* Continue w/o new mbuf */
 		goto next_rx;
-- 
2.47.3