[PATCH v2 0/5] net/bnxt: fix flow, Rx and naming bounds issues

[Mohammad Shuab Siddique <mohammad-shuab.siddique@broadcom.com>]

From: Mohammad Shuab Siddique <mohammad-shuab.siddique@broadcom.com>

This series fixes five independent out-of-bounds issues in flow,
Rx-datapath and naming code in the bnxt PMD:

 - two stack-allocated variable-length arrays in flow-stats sizing
   that risked stack exhaustion,
 - a TPA aggregation ID read from a completion and used to index
   rxr->tpa_info[] without a bounds check,
 - three separate sprintf() calls into fixed-size buffers with no
   bound on the formatted string length, plus four related bugs
   (a leak, a stale flag, and two locks left held) introduced by
   this change's own new early-return paths and fixed here,
 - a caller-supplied MAC pool index used before being validated
   against bp->max_vnics, and an unbounded flow item/action skip
   loop that could walk off the end of the pattern array, and
 - a firmware-supplied Rx completion opaque value used unmasked as
   an rx_buf_ring[] index, an aggregation-segment count guarded only
   by a release-mode-compiled-out RTE_ASSERT, and an unclamped VF
   VNIC-count from firmware.

Each patch is independently bisectable and was validated with a
scoped net/bnxt build (and, for split points, an intermediate-commit
build) in addition to the full compliance gate.

v2:
* Patch 2/5 ("fix bounds on TPA aggregation ID from completions"):
  corrected its Fixes: tag SHA1s to the full 12-character form, and
  fixed a real bug an AI-review pass caught -- the legacy (non-Thor)
  TPA end path's new bounds-check-failure branch wasn't draining
  pending aggregation-buffer completions before returning, unlike
  the sibling in_reset early return right above it, which could
  desync the CQ consumer index. See that patch's own changelog.
* Patch 3/5 ("harden sprintf bounds for device memory names"): fixed
  a real bug an AI-review pass caught -- bnxt_hwrm_ver_get()'s new
  early return on a snprintf failure also skipped HWRM_UNLOCK(),
  unlike this same function's other error exits and the sibling
  cfa_pair_*() fixes in this same patch, which would leak
  bp->hwrm_lock and deadlock every later HWRM call. See that patch's
  own changelog.
* Patch 4/5 ("fix bounds in MAC pool index and flow parsing"): fixed
  both Fixes: tag SHA1s to the full 12-character form.
* Patch 5/5 ("fix TPA agg Rx descriptor and VNIC query bounds"):
  fixed all three Fixes: tag SHA1s to the full 12-character form.
  Also addressed (no code change needed, see that patch's changelog)
  a reviewer question about a possible leak in the agg_count-overflow
  error path.
* Patch 1/5 is unchanged from v1.

Chenna Arnoori (1):
  net/bnxt: fix bounds in MAC pool index and flow parsing

Joseph Wong (1):
  net/bnxt: fix stack exhaustion in flow stats

Keegan Freyhof (1):
  net/bnxt: harden sprintf bounds for device memory names

Kishore Padmanabha (1):
  net/bnxt: fix TPA agg Rx descriptor and VNIC query bounds

Mohammad Shuab Siddique (1):
  net/bnxt: fix bounds on TPA aggregation ID from completions

 drivers/net/bnxt/bnxt.h        | 15 +++++++
 drivers/net/bnxt/bnxt_ethdev.c | 43 +++++++++++++-------
 drivers/net/bnxt/bnxt_flow.c   | 28 +++++++++----
 drivers/net/bnxt/bnxt_hwrm.c   | 75 ++++++++++++++++++++++++++---------
 drivers/net/bnxt/bnxt_rxr.c    | 58 +++++++++++++++++++++-------
 drivers/net/bnxt/bnxt_stats.c  | 18 ++++-----
 6 files changed, 175 insertions(+), 62 deletions(-)

--
2.47.3