From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A63D33DE449 for ; Thu, 2 Apr 2026 11:46:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775130398; cv=none; b=SifX8zfDZPIrtOJ0gJ2kB981UKJRfwEYeLilwtMGruyDsELUCo7JZoj7sYZjhJbIkWcW1yhb2kXrPpIwTN/Ban2QkmKj8HRzmCd571wnXW0JKAWzx9kPAHsxG+Acw/T0A54Nrjc2WOo9/cKuJyHezvVmm5IdEjsuC9brgX9iKXk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775130398; c=relaxed/simple; bh=96/WVMIDSBKKgJSfQ4EIO42g3fE0wTNJnou+Effn79M=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=LYfL3Z/bGwYKSaxV8XgURexgmWhTUulaXnuuelUdFP8XLgzPp/JzcQo6ru8hqfaLgarqVV13d/doivAiyNxx5YU4QkPKDIYOsC084ROQBDGze9cavGYuFRB2ywkz2jNdLidwAYj17QnBcf3J4dfMtKxqbMFJwUebiHnfXhAGeJA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=UPhOcr/Q; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=enP1a3Or; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="UPhOcr/Q"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="enP1a3Or" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1775130389; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=WURTvV+4CxxPQ1jYB89C/0nV6RrkAMgvkGrvpp0Vmfk=; b=UPhOcr/QGPtWmNzdv/wi2PljI+aNH2/qsv4IVAGrlw7A8fVIXWrOanGr655u5O/kWwm/C8 3uiUIhSQ331Vw81W0kGa20EAFxrfNdaD8hmvTSo/3Icv1F8zsrEz7pq92g1674EcSr5DBM R0l4tQmV5GqcdfPumjrGUGXKeXf49xw= Received: from mail-wm1-f71.google.com (mail-wm1-f71.google.com [209.85.128.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-418-s9E60pq_M5Wd6xNclp2tAg-1; Thu, 02 Apr 2026 07:46:28 -0400 X-MC-Unique: s9E60pq_M5Wd6xNclp2tAg-1 X-Mimecast-MFC-AGG-ID: s9E60pq_M5Wd6xNclp2tAg_1775130387 Received: by mail-wm1-f71.google.com with SMTP id 5b1f17b1804b1-48544725bdeso9450085e9.2 for ; Thu, 02 Apr 2026 04:46:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1775130387; x=1775735187; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=WURTvV+4CxxPQ1jYB89C/0nV6RrkAMgvkGrvpp0Vmfk=; b=enP1a3OrP3GpfEEarv4+JTv3C0WAGcaypormI5DRQkQ5YXwR7ky3e+AFOu1sjrnvzh 9cPQDCzWeN2b31nlCHoOf7LMNSGO7zMtmHNhZ6CSOWHa3bzZmUx4x2kfs1DlHv/+lH6g zgqCE4VCWfAqrFuA+BwVmuZwTEjXd5dijRpvrLtt+bN0KDpJ2cMNImME1kxkwAFVZFhi iNL3vRXdE+mTi+vcHzNFfHtRF0IIzuo1JwhOEIekOFDT1JqfiRcGK7CA5fD3+3HlfQ7l yKQlr15Qr8m1ygIf+FjX/EBQcgBwL6N04bb1KpzBntxJS0GVg5ha2OU8Rm9YSxpHGYF6 q1EA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775130387; x=1775735187; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=WURTvV+4CxxPQ1jYB89C/0nV6RrkAMgvkGrvpp0Vmfk=; b=QAZjoGvXbeVA3CjcqIa3wP/uud75tbWf2Rc1tcUaSlZMLnKVyL0znZSEFbkAivMqWU uSruSHvAgI75Ol2NGoQiMHTpvqS9GElhm8GonAyto/IQgiE9oIqoZik7ZqV1jKknuwLt NvTjROFVqQrKtO5nMrfchmh/ur2rgTOSBbQwahiBa0dh2x17ljm8Q09LDyiVURGtyLGg v6GdI7NSo3n78WiwdBcvVrW6p0obLUJzXhrUP02pW0UfF93Aapf1pXYe+0rm7fn9Hglz V+2QpKqYvWeZQQD940ntjU9GRVpqrcBbCqr6X3UNWho093w5PuSwEg7fJxVs4MzZkAPk AMnw== X-Forwarded-Encrypted: i=1; AJvYcCWc57PdLJCmIRTsXLC/yXxNDIN91iH9YP6gHcs4/+A+hipCfITZdkNcVfAjKS617A/LmvhWx4zOx1JmZKY=@vger.kernel.org X-Gm-Message-State: AOJu0YyAxhubY0YjrriH0F2mkiixROmdspDjmV6hDTMdLqQk1+a5Du6T G6VsqPv2wHIsxnLkTvS5SKuH7a9Kh1K9YKB5BL3uTQId6w1vKYlSUVTlfSNlxxOw8gGopCZGU1e mRZoyqsBHFsx0ma74KAT9CGToc0jZn9+QJ0IuyYOS6G3cDhAXrAH0FfUVDUbUdjv/yQ== X-Gm-Gg: ATEYQzz1WH/TGpTe3+ikIsjdCUb6KHQVIjDXVcqHToEB34pw2Gwh/MVJEv0FjbnS5QE 1gsadeR6ywzeDDaf6ZdQLhkwwkP4oVgOBfJOCbA1aIJjtotw0Ccu4LXjJPH2kLt92jFrwP3NjmD 4UZvyCNG50uKRuwgYT73xvLHwPw8Jt4bupbBgtCkIWLgk5NU51Q/5brMebNVKF5ikAjo9r/whox go938JN6YZ7HzDzA3LnDyPceVY5oJxk+/Vc5Rp9e0LGILOBEj2v7a5IwDexlRkCASlhYJYeqjUc xQ7nHkAEJFFeVW1DB1Tb8WQaA2BZ7NsUMVF/i7zisWPmRBHM7Yo9pj1LqtbPUXjUBxWhCXVXnXg p0vPdxE2g6dX05bXNCJNAOL3lhtJs1P0TyoP7FJ3Y3k8QOVBPOf2nSQftDw== X-Received: by 2002:a05:600c:a406:b0:483:709e:f238 with SMTP id 5b1f17b1804b1-4888b7a0b07mr41585325e9.29.1775130387291; Thu, 02 Apr 2026 04:46:27 -0700 (PDT) X-Received: by 2002:a05:600c:a406:b0:483:709e:f238 with SMTP id 5b1f17b1804b1-4888b7a0b07mr41585005e9.29.1775130386828; Thu, 02 Apr 2026 04:46:26 -0700 (PDT) Received: from [192.168.88.32] ([212.105.153.248]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4888a63c9b1sm62293295e9.5.2026.04.02.04.46.25 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 02 Apr 2026 04:46:26 -0700 (PDT) Message-ID: Date: Thu, 2 Apr 2026 13:46:24 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH net] bnxt_en: fix out-of-bounds write in bnxt_alloc_vf_resources() To: Junrui Luo , Michael Chan , Pavan Chebbi , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Prashant Sreedharan , Jeffrey Huang , Eddie Wai Cc: Michael Chan , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Yuhao Jiang , stable@vger.kernel.org References: Content-Language: en-US From: Paolo Abeni In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 3/31/26 11:57 AM, Junrui Luo wrote: > bnxt_alloc_vf_resources() derives the number of DMA pages for VF HWRM > command buffers from num_vfs and stores them in the fixed-size arrays > hwrm_cmd_req_addr[4] and hwrm_cmd_req_dma_addr[4]. The vf_event_bmap > bitmap is similarly fixed at 128 bits. > > If num_vfs exceeds 128, the allocation loop writes past the arrays, > corrupting adjacent fields in bnxt_pf_info. > > Add BNXT_MAX_VFS to cap num_vfs at 128, matching the existing array and > bitmap capacity. > > Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") > Reported-by: Yuhao Jiang > Cc: stable@vger.kernel.org > Signed-off-by: Junrui Luo > --- > drivers/net/ethernet/broadcom/bnxt/bnxt.h | 2 ++ > drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c | 6 ++++++ > 2 files changed, 8 insertions(+) > > diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h > index a97d651130df..cee67ca2955d 100644 > --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h > +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h > @@ -1398,6 +1398,8 @@ struct bnxt_vf_info { > }; > #endif > > +#define BNXT_MAX_VFS 128 > + > struct bnxt_pf_info { > #define BNXT_FIRST_PF_FID 1 > #define BNXT_FIRST_VF_FID 128 > diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c > index 7f9829287c49..18ac0aaf4166 100644 > --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c > +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c > @@ -459,6 +459,12 @@ static int bnxt_alloc_vf_resources(struct bnxt *bp, int num_vfs) > struct pci_dev *pdev = bp->pdev; > u32 nr_pages, size, i, j, k = 0; > > + if (num_vfs > BNXT_MAX_VFS) { > + netdev_warn(bp->dev, "Too many VFs (%d), max is %d\n", > + num_vfs, BNXT_MAX_VFS); > + return -EINVAL; > + } > + > bp->pf.vf = kzalloc_objs(struct bnxt_vf_info, num_vfs); > if (!bp->pf.vf) > return -ENOMEM; > Makes sense to me. It would be nice some explicit ack/testing from someone @broadcom. Thanks, Paolo