Re: [PATCH net 2/5] eth: nfp: bound the ntuple rule dump by the caller's buffer size

[Joe Damato <joe@dama.to>]

On Wed, Sep 02, 2026 at 08:26:08PM -0700, Jakub Kicinski wrote:
> nfp_net_get_fs_loc() dumps every entry of nn->fs.list into rule_locs[]
> without consulting cmd->rule_cnt, which is how many entries the caller
> had room for.  ETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN and the
> ioctl sizes the buffer from the rule_cnt userspace passes in, so once an
> admin has installed flow steering rules any user can ask for fewer slots
> than there are rules and run off the end of the allocation.  A rule_cnt
> of 0 leaves the buffer pointer NULL and the walk dereferences it.
> 
> Bail out with -EMSGSIZE when the buffer fills up, the way the other
> ntuple capable drivers do, and report how many locations were filled so
> a shrinking rule list does not leave the caller reading stale slots.
> 
> Reported-by: VEGA <vega@nebusec.ai>
> Fixes: 9eb03bb1c035 ("nfp: add ethtool flow steering callbacks")
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> ---
> CC: leitao@debian.org
> CC: louis.peens@corigine.com
> CC: yinjun.zhang@corigine.com
> CC: oss-drivers@corigine.com
> ---
>  drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 11 ++++++++---
>  1 file changed, 8 insertions(+), 3 deletions(-)
>

Reviewed-by: Joe Damato <joe@dama.to>