[PATCH 1/2] net/bnxt: cap memcpy at field size

[Manish Kurup]

From: Dakota Sicher <dakota.sic...@broadcom.com>

The memcpy() copying a header field's value in the parser does not
check whether the source size exceeds the field's spec size, so an
oversized value overflows the destination field.

Fixes: f63aa27db634 ("net/bnxt: support dynamic encap action")
Fixes: 741172be52de ("net/bnxt: refactor flow parser in ULP")
Cc: sta...@dpdk.org

Signed-off-by: Dakota Sicher <dakota.sic...@broadcom.com>
Signed-off-by: Manish Kurup <manish.ku...@broadcom.com>
---
 drivers/net/bnxt/tf_ulp/ulp_rte_parser.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/net/bnxt/tf_ulp/ulp_rte_parser.c 
b/drivers/net/bnxt/tf_ulp/ulp_rte_parser.c
index 442a795430..12f9cb80e9 100644
--- a/drivers/net/bnxt/tf_ulp/ulp_rte_parser.c
+++ b/drivers/net/bnxt/tf_ulp/ulp_rte_parser.c
@@ -66,6 +66,11 @@ ulp_rte_parser_fld_copy(struct ulp_rte_hdr_field *field,
                        const void *buffer,
                        uint32_t size)
 {
+       if (unlikely(size > RTE_PARSER_FLOW_HDR_FIELD_SIZE)) {
+               BNXT_DRV_DBG(ERR, "Field size %u exceeds max of %u, clamping",
+                            size, RTE_PARSER_FLOW_HDR_FIELD_SIZE);
+               size = RTE_PARSER_FLOW_HDR_FIELD_SIZE;
+       }
        field->size = size;
        memcpy(field->spec, buffer, field->size);
        field++;
@@ -106,6 +111,11 @@ ulp_rte_prsr_fld_mask(struct ulp_rte_parser_params *params,
 {
        struct ulp_rte_hdr_field *field = &params->hdr_field[*idx];
 
+       if (unlikely(size > RTE_PARSER_FLOW_HDR_FIELD_SIZE)) {
+               BNXT_DRV_DBG(ERR, "Field size %u exceeds max of %u, clamping",
+                            size, RTE_PARSER_FLOW_HDR_FIELD_SIZE);
+               size = RTE_PARSER_FLOW_HDR_FIELD_SIZE;
+       }
        /* update the field size */
        field->size = size;
 
-- 
2.31.1