[PATCH v2 4/5] net/bnxt: fix bounds in MAC pool index and flow parsing

[Stephen Hemminger]

On Sun, 20 Sep 2026 20:24:19 -0600
Mohammad Shuab Siddique <mohammad-shuab.siddique at broadcom.com> wrote:

> From: Chenna Arnoori <chenna.arnoori at broadcom.com>
> 
> Two independent out-of-bounds issues in the driver:
> 
> - bnxt_mac_addr_add_op() indexed bp->vnic_info[pool] with a
>   caller-supplied pool before validating it against bp->max_vnics, and
>   before checking bp->vnic_info was even allocated yet (it is NULL
>   until the port is started). The existing "if (!vnic)" check was
>   always false, since vnic held the address of an array element and
>   is never NULL. Reorder to check dev_started/vnic_info first, then
>   bounds-check pool against max_vnics before indexing.
> 
> - bnxt_flow_non_void_item()/bnxt_flow_non_void_action() looped
>   unconditionally until a non-VOID item/action was found, walking off
>   the end of a pattern/actions array that lacked a terminating END
>   item. Bound the skip loop and stop advancing once the limit is hit.
> 
> Fixes: 51fafb89a9a0 ("net/bnxt: get rid of ff pools and use VNIC info array")
> Fixes: 5c1171c97216 ("net/bnxt: refactor filter/flow")
> Cc: stable at dpdk.org
> 
> Signed-off-by: Chenna Arnoori <chenna.arnoori at broadcom.com>
> Signed-off-by: Mohammad Shuab Siddique <mohammad-shuab.siddique at broadcom.com>
> ---




[PATCH v2 4/5] net/bnxt: fix bounds in MAC pool index and flow
parsing

Warning: the bounded VOID skip does not bound the walk. The outer
loops in bnxt_filter_type_check() and
bnxt_validate_and_parse_flow_type() run while type != END. After 256
VOIDs the helper returns a VOID item, and the loop calls it again at
item + 1. A pattern without END is still walked off the end, and
non-VOID items are never counted. The rte_flow API requires the END
terminator. Drop this half of the patch.

The added "if (!cur) return NULL" paths return a value that no
caller checks.

Warning: in bnxt_mac_addr_add_op() the pool bounds check comes after
the dev_started early return. An invalid pool added while the port
is stopped returns 0, is recorded in mac_pool_sel, and then fails
later in bnxt_restore_mac_filters() at dev_start. Validate pool
against bp->max_vnics before the dev_started test. The
bp->vnic_info == NULL test after dev_started is dead code.