[PATCH net] bnxt_en: fix out-of-bounds write in bnxt_alloc_vf_resources()

[PATCH net] bnxt_en: fix out-of-bounds write in bnxt_alloc_vf_resources()

[Junrui Luo]

bnxt_alloc_vf_resources() derives the number of DMA pages for VF HWRM
command buffers from num_vfs and stores them in the fixed-size arrays
hwrm_cmd_req_addr[4] and hwrm_cmd_req_dma_addr[4]. The vf_event_bmap
bitmap is similarly fixed at 128 bits.

If num_vfs exceeds 128, the allocation loop writes past the arrays,
corrupting adjacent fields in bnxt_pf_info.

Add BNXT_MAX_VFS to cap num_vfs at 128, matching the existing array and
bitmap capacity.

Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.h       | 2 ++
 drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c | 6 ++++++
 2 files changed, 8 insertions(+)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
index a97d651130df..cee67ca2955d 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
@@ -1398,6 +1398,8 @@ struct bnxt_vf_info {
 };
 #endif
 
+#define BNXT_MAX_VFS	128
+
 struct bnxt_pf_info {
 #define BNXT_FIRST_PF_FID	1
 #define BNXT_FIRST_VF_FID	128
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
index 7f9829287c49..18ac0aaf4166 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
@@ -459,6 +459,12 @@ static int bnxt_alloc_vf_resources(struct bnxt *bp, int num_vfs)
 	struct pci_dev *pdev = bp->pdev;
 	u32 nr_pages, size, i, j, k = 0;
 
+	if (num_vfs > BNXT_MAX_VFS) {
+		netdev_warn(bp->dev, "Too many VFs (%d), max is %d\n",
+			    num_vfs, BNXT_MAX_VFS);
+		return -EINVAL;
+	}
+
 	bp->pf.vf = kzalloc_objs(struct bnxt_vf_info, num_vfs);
 	if (!bp->pf.vf)
 		return -ENOMEM;

---
base-commit: c369299895a591d96745d6492d4888259b004a9e
change-id: 20260331-fixes-ee2efcc963a3

Best regards,
-- 
Junrui Luo <moonafterrain@outlook.com>

Re: [PATCH net] bnxt_en: fix out-of-bounds write in bnxt_alloc_vf_resources()

[Paolo Abeni]

On 3/31/26 11:57 AM, Junrui Luo wrote:
> bnxt_alloc_vf_resources() derives the number of DMA pages for VF HWRM
> command buffers from num_vfs and stores them in the fixed-size arrays
> hwrm_cmd_req_addr[4] and hwrm_cmd_req_dma_addr[4]. The vf_event_bmap
> bitmap is similarly fixed at 128 bits.
> 
> If num_vfs exceeds 128, the allocation loop writes past the arrays,
> corrupting adjacent fields in bnxt_pf_info.
> 
> Add BNXT_MAX_VFS to cap num_vfs at 128, matching the existing array and
> bitmap capacity.
> 
> Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
> Reported-by: Yuhao Jiang <danisjiang@gmail.com>
> Cc: stable@vger.kernel.org
> Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
> ---
>  drivers/net/ethernet/broadcom/bnxt/bnxt.h       | 2 ++
>  drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c | 6 ++++++
>  2 files changed, 8 insertions(+)
> 
> diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
> index a97d651130df..cee67ca2955d 100644
> --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
> +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
> @@ -1398,6 +1398,8 @@ struct bnxt_vf_info {
>  };
>  #endif
>  
> +#define BNXT_MAX_VFS	128
> +
>  struct bnxt_pf_info {
>  #define BNXT_FIRST_PF_FID	1
>  #define BNXT_FIRST_VF_FID	128
> diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
> index 7f9829287c49..18ac0aaf4166 100644
> --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
> +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
> @@ -459,6 +459,12 @@ static int bnxt_alloc_vf_resources(struct bnxt *bp, int num_vfs)
>  	struct pci_dev *pdev = bp->pdev;
>  	u32 nr_pages, size, i, j, k = 0;
>  
> +	if (num_vfs > BNXT_MAX_VFS) {
> +		netdev_warn(bp->dev, "Too many VFs (%d), max is %d\n",
> +			    num_vfs, BNXT_MAX_VFS);
> +		return -EINVAL;
> +	}
> +
>  	bp->pf.vf = kzalloc_objs(struct bnxt_vf_info, num_vfs);
>  	if (!bp->pf.vf)
>  		return -ENOMEM;
> 

Makes sense to me. It would be nice some explicit ack/testing from
someone @broadcom.

Thanks,

Paolo

Re: [PATCH net] bnxt_en: fix out-of-bounds write in bnxt_alloc_vf_resources()

[Jakub Kicinski]

On Tue, 31 Mar 2026 17:57:10 +0800 Junrui Luo wrote:
> bnxt_alloc_vf_resources() derives the number of DMA pages for VF HWRM
> command buffers from num_vfs and stores them in the fixed-size arrays
> hwrm_cmd_req_addr[4] and hwrm_cmd_req_dma_addr[4]. The vf_event_bmap
> bitmap is similarly fixed at 128 bits.
> 
> If num_vfs exceeds 128, the allocation loop writes past the arrays,
> corrupting adjacent fields in bnxt_pf_info.
> 
> Add BNXT_MAX_VFS to cap num_vfs at 128, matching the existing array and
> bitmap capacity.
> 
> Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
> Reported-by: Yuhao Jiang <danisjiang@gmail.com>
> Cc: stable@vger.kernel.org
> Signed-off-by: Junrui Luo <moonafterrain@outlook.com>

Quick Google search reveals that BCM957608 is supposed to support
1k VFs so I suspect Broadcom may be scrambling for a real fix here.
I'll drop this from patchwork.

Michael, if my hunch is correct please make sure to credit the reporter.
If you just need more time to validate - please take this in and repost
once ready. patches older than 1 week "fall out" of our patch tracking
:(