[RFC] net/bnxt: fix buffer overflow in TF set message helpers

[RFC] net/bnxt: fix buffer overflow in TF set message helpers

[Stephen Hemminger]

LTO build with -Werror reports stack overflows in tf_msg.c:

  In function 'tf_global_cfg_set':
  rte_memcpy.h:91:9: error: writing 16 bytes into a region of size 8
  tf_msg.c:1574:45: note: at offset 48 into destination object 'req'
  of size 56

  In function 'tf_msg_set_if_tbl_entry':
  rte_memcpy.h:105:9: error: writing 32 bytes into a region of size 0
  tf_msg.c:1813:41: note: at offset 136 into destination object 'req'
  of size 128

tf_msg_set_global_cfg() limits config_sz_in_bytes to 16, but
req.data and req.mask are each 8 bytes. A config larger than 8 bytes
overruns data into mask, and the mask copy runs off the end of req.

tf_msg_set_if_tbl_entry() has no check at all. data_sz_in_bytes is a
uint16_t copied into the 88 byte req.data. The ULP mapper fills it
from a blob of up to 128 bytes.

Check both against sizeof() of the destination, as the matching get
functions already do.

Fixes: 98487d729b4a ("net/bnxt: cleanup and refactor session management")
Cc: stable@dpdk.org

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
 drivers/net/bnxt/tf_core/tf_msg.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/bnxt/tf_core/tf_msg.c b/drivers/net/bnxt/tf_core/tf_msg.c
index aab8d05d81..ab03afaabd 100644
--- a/drivers/net/bnxt/tf_core/tf_msg.c
+++ b/drivers/net/bnxt/tf_core/tf_msg.c
@@ -23,7 +23,6 @@
  * means we have to manually sync hwrm with these defines if the
  * tf.yaml changes.
  */
-#define TF_MSG_SET_GLOBAL_CFG_DATA_SIZE  16
 #define TF_MSG_EM_INSERT_KEY_SIZE        64
 #define TF_MSG_EM_INSERT_RECORD_SIZE     96
 #define TF_MSG_TBL_TYPE_SET_DATA_SIZE    88
@@ -1618,7 +1617,7 @@ tf_msg_set_global_cfg(struct tf *tfp,
 	req.offset = tfp_cpu_to_le_32(params->offset);
 
 	/* Check for data size conformity */
-	if (params->config_sz_in_bytes > TF_MSG_SET_GLOBAL_CFG_DATA_SIZE) {
+	if (params->config_sz_in_bytes > sizeof(req.data)) {
 		rc = -EINVAL;
 		TFP_DRV_LOG(ERR,
 			    "%s: Invalid parameters for msg type, rc:%s\n",
@@ -1816,6 +1815,9 @@ tf_msg_set_if_tbl_entry(struct tf *tfp,
 	struct tf_dev_info *dev;
 	struct tf_session *tfs;
 
+	if (params->data_sz_in_bytes > sizeof(req.data))
+		return -EINVAL;
+
 	/* Retrieve the session information */
 	rc = tf_session_get_session(tfp, &tfs);
 	if (rc) {
-- 
2.53.0

Re: [RFC] net/bnxt: fix buffer overflow in TF set message helpers

[Kishore Padmanabha]

[-- Attachment #1.1: Type: text/plain, Size: 2782 bytes --]

On Tue, Oct 27, 2026 at 11:53 PM Stephen Hemminger <
stephen@networkplumber.org> wrote:

> LTO build with -Werror reports stack overflows in tf_msg.c:
>
>   In function 'tf_global_cfg_set':
>   rte_memcpy.h:91:9: error: writing 16 bytes into a region of size 8
>   tf_msg.c:1574:45: note: at offset 48 into destination object 'req'
>   of size 56
>
>   In function 'tf_msg_set_if_tbl_entry':
>   rte_memcpy.h:105:9: error: writing 32 bytes into a region of size 0
>   tf_msg.c:1813:41: note: at offset 136 into destination object 'req'
>   of size 128
>
> tf_msg_set_global_cfg() limits config_sz_in_bytes to 16, but
> req.data and req.mask are each 8 bytes. A config larger than 8 bytes
> overruns data into mask, and the mask copy runs off the end of req.
>
> tf_msg_set_if_tbl_entry() has no check at all. data_sz_in_bytes is a
> uint16_t copied into the 88 byte req.data. The ULP mapper fills it
> from a blob of up to 128 bytes.
>
> Check both against sizeof() of the destination, as the matching get
> functions already do.
>
> Fixes: 98487d729b4a ("net/bnxt: cleanup and refactor session management")
> Cc: stable@dpdk.org
>
> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
>
Acked-by: Kishore Padmanabha <kishore.padmanabha@broadcom.com>

> ---
>  drivers/net/bnxt/tf_core/tf_msg.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/bnxt/tf_core/tf_msg.c
> b/drivers/net/bnxt/tf_core/tf_msg.c
> index aab8d05d81..ab03afaabd 100644
> --- a/drivers/net/bnxt/tf_core/tf_msg.c
> +++ b/drivers/net/bnxt/tf_core/tf_msg.c
> @@ -23,7 +23,6 @@
>   * means we have to manually sync hwrm with these defines if the
>   * tf.yaml changes.
>   */
> -#define TF_MSG_SET_GLOBAL_CFG_DATA_SIZE  16
>  #define TF_MSG_EM_INSERT_KEY_SIZE        64
>  #define TF_MSG_EM_INSERT_RECORD_SIZE     96
>  #define TF_MSG_TBL_TYPE_SET_DATA_SIZE    88
> @@ -1618,7 +1617,7 @@ tf_msg_set_global_cfg(struct tf *tfp,
>         req.offset = tfp_cpu_to_le_32(params->offset);
>
>         /* Check for data size conformity */
> -       if (params->config_sz_in_bytes > TF_MSG_SET_GLOBAL_CFG_DATA_SIZE) {
> +       if (params->config_sz_in_bytes > sizeof(req.data)) {
>                 rc = -EINVAL;
>                 TFP_DRV_LOG(ERR,
>                             "%s: Invalid parameters for msg type, rc:%s\n",
> @@ -1816,6 +1815,9 @@ tf_msg_set_if_tbl_entry(struct tf *tfp,
>         struct tf_dev_info *dev;
>         struct tf_session *tfs;
>
> +       if (params->data_sz_in_bytes > sizeof(req.data))
> +               return -EINVAL;
> +
>         /* Retrieve the session information */
>         rc = tf_session_get_session(tfp, &tfs);
>         if (rc) {
> --
> 2.53.0
>
>

[-- Attachment #1.2: Type: text/html, Size: 3839 bytes --]

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5493 bytes --]