Kees Cook d3e599c090 bnxt: Do not read past the end of test names ...

Test names were being concatenated based on a offset beyond the end of
the first name, which tripped the buffer overflow detection logic:

 detected buffer overflow in strnlen
 [...]
 Call Trace:
 bnxt_ethtool_init.cold+0x18/0x18

Refactor struct hwrm_selftest_qlist_output to use an actual array,
and adjust the concatenation to use snprintf() rather than a series of
strncat() calls.

Reported-by: Niklas Cassel <Niklas.Cassel@wdc.com>
Link: https://lore.kernel.org/lkml/Y8F%2F1w1AZTvLglFX@x1-carbon/
Tested-by: Niklas Cassel <Niklas.Cassel@wdc.com>
Fixes: eb51365846 ("bnxt_en: Add basic ethtool -t selftest support.")
Cc: Michael Chan <michael.chan@broadcom.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Reviewed-by: Niklas Cassel <niklas.cassel@wdc.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2023-01-20 12:52:29 +00:00

..

bnxt_coredump.c

bnxt_en: use firmware provided max timeout for messages

2022-01-09 16:27:23 -08:00

bnxt_coredump.h

bnxt_en: move coredump functions into dedicated file

2021-10-29 12:13:05 +01:00

bnxt_dcb.c

bnxt_en: Properly report no pause support on some cards

2022-03-05 11:16:56 +00:00

bnxt_dcb.h

bnxt_en: Use struct_group_attr() for memcpy() region

2021-09-25 08:20:48 -07:00

bnxt_debugfs.c

…

bnxt_debugfs.h

…

bnxt_devlink.c

net: devlink: let the core report the driver name instead of the drivers

2022-11-30 21:49:38 -08:00

bnxt_devlink.h

bnxt: revert hastily merged uAPI aberrations

2022-03-09 19:55:00 -08:00

bnxt_dim.c

…

bnxt_ethtool.c

bnxt: Do not read past the end of test names

2023-01-20 12:52:29 +00:00

bnxt_ethtool.h

bnxt_en: implement callbacks for devlink selftests

2022-07-28 21:56:53 -07:00

bnxt_fw_hdr.h

…

bnxt_hsi.h

bnxt: Do not read past the end of test names

2023-01-20 12:52:29 +00:00

bnxt_hwrm.c

bnxt_en: fix the handling of PCIE-AER

2022-11-04 19:29:02 -07:00

bnxt_hwrm.h

bnxt_en: Increase firmware message response DMA wait time

2022-02-20 13:47:15 +00:00

bnxt_nvm_defs.h

…

bnxt_ptp.c

ptp: bnxt: convert .adjfreq to .adjfine

2022-11-11 10:58:39 +00:00

bnxt_ptp.h

bnxt_en: Add a non-real time mode to access NIC clock

2022-11-08 12:39:02 +01:00

bnxt_sriov.c

bnxt_en: fix NQ resource accounting during vf creation on 57500 chips

2022-08-23 15:32:17 -07:00

bnxt_sriov.h

ethernet: constify references to netdev->dev_addr in drivers

2021-10-14 09:22:11 -07:00

bnxt_tc.c

flow_offload: reject to offload tc actions in offload drivers

2021-12-19 14:08:47 +00:00

bnxt_tc.h

…

bnxt_ulp.c

eth: bnxt: make ulp_id unsigned to make GCC 12 happy

2022-05-20 17:30:19 -07:00

bnxt_ulp.h

eth: bnxt: make ulp_id unsigned to make GCC 12 happy

2022-05-20 17:30:19 -07:00

bnxt_vfr.c

net: ethernet: move from strlcpy with unused retval to strscpy

2022-08-31 14:11:26 -07:00

bnxt_vfr.h

bnxt_en: Free and allocate VF-Reps during error recovery.

2021-04-12 13:20:38 -07:00

bnxt_xdp.c

bnxt_en: Fix first buffer size calculations for XDP multi-buffer

2022-12-28 10:16:57 +00:00

bnxt_xdp.h

bnxt_en: Fix XDP RX path

2022-12-28 10:16:57 +00:00

bnxt.c

bnxt: make sure we return pages to the pool

2023-01-11 20:48:37 -08:00

bnxt.h

bnxt_en: Fix first buffer size calculations for XDP multi-buffer

2022-12-28 10:16:57 +00:00

Makefile

bnxt_en: move coredump functions into dedicated file

2021-10-29 12:13:05 +01:00