[PATCH 0/5] net/bnxt: fix flow, Rx and naming bounds issues

[Mohammad Shuab Siddique <mohammad-shuab.siddique@broadcom.com>]

From: Mohammad Shuab Siddique <mohammad-shuab.siddique@broadcom.com>

This series fixes five independent out-of-bounds issues in flow,
Rx-datapath and naming code in the bnxt PMD:

 - two stack-allocated variable-length arrays in flow-stats sizing
   that risked stack exhaustion,
 - a TPA aggregation ID read from a completion and used to index
   rxr->tpa_info[] without a bounds check,
 - three separate sprintf() calls into fixed-size buffers with no
   bound on the formatted string length, plus three related bugs
   (a leak, a stale flag, and a lock left held) introduced by this
   change's own new early-return paths and fixed here,
 - a caller-supplied MAC pool index used before being validated
   against bp->max_vnics, and an unbounded flow item/action skip
   loop that could walk off the end of the pattern array, and
 - a firmware-supplied Rx completion opaque value used unmasked as
   an rx_buf_ring[] index, an aggregation-segment count guarded only
   by a release-mode-compiled-out RTE_ASSERT, and an unclamped VF
   VNIC-count from firmware.

Each patch is independently bisectable and was validated with a
scoped net/bnxt build (and, for split points, an intermediate-commit
build) in addition to the full compliance gate.

Chenna Arnoori (1):
  net/bnxt: fix bounds in MAC pool index and flow parsing

Joseph Wong (1):
  net/bnxt: fix stack exhaustion in flow stats

Keegan Freyhof (1):
  net/bnxt: harden sprintf bounds for device memory names

Kishore Padmanabha (1):
  net/bnxt: fix TPA agg Rx descriptor and VNIC query bounds

Mohammad Shuab Siddique (1):
  net/bnxt: fix bounds on TPA aggregation ID from completions

 drivers/net/bnxt/bnxt.h        | 15 +++++++
 drivers/net/bnxt/bnxt_ethdev.c | 43 +++++++++++++-------
 drivers/net/bnxt/bnxt_flow.c   | 28 +++++++++----
 drivers/net/bnxt/bnxt_hwrm.c   | 74 +++++++++++++++++++++++++---------
 drivers/net/bnxt/bnxt_rxr.c    | 57 ++++++++++++++++++++------
 drivers/net/bnxt/bnxt_stats.c  | 18 ++++-----
 6 files changed, 173 insertions(+), 62 deletions(-)

-- 
2.47.3