[PATCH] net/bnxt: fix bounds in RSS queue match and ctx initializer

[Mohammad Shuab Siddique]

From: Kishore Padmanabha <kishore.padmanabha at broadcom.com>

Two independent out-of-bounds issues:

- match_vnic_rss_cfg() indexed bp->rx_queues[] with firmware/
  application-supplied RSS queue IDs without validating them against
  bp->rx_nr_rings first, and dereferenced the resulting (possibly
  NULL) queue pointer unconditionally.

- bnxt_init_ctx_initializer() computed ctxm->init_offset from a
  firmware-supplied byte offset without checking it against the
  context entry's own size, allowing an out-of-range init offset to
  be used later when initializing backing-store entries.

Fixes: adc0f81c6552 ("net/bnxt: support RSS action")
Fixes: fe2f715ca580 ("net/bnxt: support backing store v2")
Cc: stable at dpdk.org

Signed-off-by: Kishore Padmanabha <kishore.padmanabha at broadcom.com>
Signed-off-by: Mohammad Shuab Siddique <mohammad-shuab.siddique at broadcom.com>
---
 drivers/net/bnxt/bnxt_flow.c | 13 +++++++++++++
 drivers/net/bnxt/bnxt_hwrm.c | 14 +++++++++++---
 2 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/drivers/net/bnxt/bnxt_flow.c b/drivers/net/bnxt/bnxt_flow.c
index a2e590540b..12d21c4853 100644
--- a/drivers/net/bnxt/bnxt_flow.c
+++ b/drivers/net/bnxt/bnxt_flow.c
@@ -968,10 +968,23 @@ static int match_vnic_rss_cfg(struct bnxt *bp,
 {
 	unsigned int match = 0, i;
 
+	if (rss->queue_num > bp->rx_nr_rings)
+		return -EINVAL;
+
 	if (vnic->rx_queue_cnt != rss->queue_num)
 		return -EINVAL;
 
 	for (i = 0; i < rss->queue_num; i++) {
+		if (rss->queue[i] >= bp->rx_nr_rings) {
+			PMD_DRV_LOG_LINE(ERR, "Queue ID %u for RSS exceeds ring count %u",
+					 rss->queue[i], bp->rx_nr_rings);
+			return -EINVAL;
+		}
+		if (!bp->rx_queues[rss->queue[i]]) {
+			PMD_DRV_LOG_LINE(ERR, "Queue ID %u for RSS is not configured",
+					 rss->queue[i]);
+			return -EINVAL;
+		}
 		if (!bp->rx_queues[rss->queue[i]]->vnic->rx_queue_cnt &&
 		    !bp->rx_queues[rss->queue[i]]->rx_started)
 			return -EINVAL;
diff --git a/drivers/net/bnxt/bnxt_hwrm.c b/drivers/net/bnxt/bnxt_hwrm.c
index 1615b36aae..8d2253160f 100644
--- a/drivers/net/bnxt/bnxt_hwrm.c
+++ b/drivers/net/bnxt/bnxt_hwrm.c
@@ -6770,10 +6770,18 @@ static void bnxt_init_ctx_initializer(struct bnxt_ctx_mem *ctxm,
 {
 	ctxm->init_value = init_val;
 	ctxm->init_offset = BNXT_CTX_INIT_INVALID_OFFSET;
-	if (init_mask_set)
-		ctxm->init_offset = init_offset * 4;
-	else
+	if (init_mask_set) {
+		ctxm->init_offset = (uint16_t)(init_offset * 4);
+		if (ctxm->init_offset >= ctxm->entry_size) {
+			PMD_DRV_LOG_LINE(WARNING,
+					 "ctx type 0x%x: init_offset %u >= entry_size %u, disabling init",
+					 ctxm->type, ctxm->init_offset, ctxm->entry_size);
+			ctxm->init_value = 0;
+			ctxm->init_offset = BNXT_CTX_INIT_INVALID_OFFSET;
+		}
+	} else {
 		ctxm->init_value = 0;
+	}
 }
 
 static int bnxt_alloc_all_ctx_pg_info(struct bnxt *bp)
-- 
2.47.3