[PATCH v2 0/5] net/bnxt: fix VF and firmware-facing bounds/leak issues

[Mohammad Shuab Siddique <mohammad-shuab.siddique@broadcom.com>]

From: Mohammad Shuab Siddique <mohammad-shuab.siddique@broadcom.com>

This series fixes five independent out-of-bounds and memory-leak
issues in VF- and firmware-facing control-path code in the bnxt PMD:

 - an unvalidated, firmware-controlled VF ID used to index
   bp->pf->vf_info[] before range-checking it,
 - firmware-reported ring-group/L2-context counts that were not
   clamped before being cast down or summed,
 - a use-after-free in the VNIC filter list walk during cleanup
   (STAILQ_FOREACH() dereferencing a node this loop had already
   freed),
 - a memory leak on the VF VNIC query error path, and
 - a memory leak on the VF info allocation error path.

Each patch is independently bisectable and was validated with a
scoped net/bnxt build (and, for split points, an intermediate-commit
build) in addition to the full compliance gate.

v2:
* Patch 2/5 and patch 5/5 had their Fixes: tag SHA1s corrected to the
  full 12-character form per checkpatch's BAD_FIXES_TAG warning. No
  functional/code changes anywhere in this series -- patches 1/5,
  3/5 and 4/5 are unchanged from v1.

Joseph Wong (3):
  net/bnxt: add VF ID boundary check before usage
  net/bnxt: fix bounds on firmware-reported resource counts
  net/bnxt: fix VF info alloc error path memory leak

Kishore Padmanabha (1):
  net/bnxt: fix memory leak in VF VNIC query error path

Mohammad Shuab Siddique (1):
  net/bnxt: fix use-after-free in VNIC filter cleanup

 drivers/net/bnxt/bnxt.h      |  3 +++
 drivers/net/bnxt/bnxt_cpr.c  | 25 ++++++++++++++-----------
 drivers/net/bnxt/bnxt_hwrm.c | 31 +++++++++++++++++++++----------
 3 files changed, 38 insertions(+), 21 deletions(-)

--
2.47.3