From nobody Thu Oct 29 23:37:09 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jG0xy5lQ6z6xr4k for ; Thu, 29 Oct 2026 23:37:10 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jG0xx4sgHz4sn1 for ; Thu, 29 Oct 2026 23:37:09 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793317029; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ynrlhjC6hj5xeRb9ATOAcgdzbffVa29su/ELbk2BOHI=; b=HbNQtUJWysXaXpyrOHKYk+608FGKnhQwHWH7BvUy/Ek5S+7CuwDcvvtmkubW7zhdJvao97 LEPtz5a70l2TW8FckiP+pHFnKB/p0cMKYPCr2HEVvoRe8RyQJD4sbC89+6fUb6qgWnkugV Z4F/bDG0y/GsNRZ/5sa/TSa8paG+hRyN9JgYYoiwywVZ0iyNajMbM9pK5zL63gwZQO5NY/ /x9VDlwaxYv5i4pXe/iU6avNfGD5urDrFK1cLKwPuu8TnGrbi9ffc7ms2iYi0yEPM0BtHy qPc2MKYY/oiS1Hf85JPvfi9dOW7oTI0BmdV0NNSQVXVKL5FsWC8tamC9JjFOHg== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793317029; b=wJ5ZKb70pZcChRGWhXHCBh+nWJcff7L5k2qkHGc8sOSblXs2eZz82GUjqlYq393Vg8vR1o pAIgPlmr2pLtIFl0PLcNnrA3Es2sOSb7V69Yi8e2E0+cLair3b7IYSlKhWZ8EilDLHvOgY Qao8D+5UW2PHrjPEDUXqjEMvM9Qpd8xL5Ts12nAGmQDv3/VI5kt4317pefCElcagLz6H/G fk7Ix8vr/4rAWCPwWrWCaNmrlO/UB5aMt2KUGDSm0VJkuFJ9O2JpZZ3Jy0FfOm7uN8cerd 5Q4Df6YZuVhBNc6+7if6kyIOB8IGAk/K1nyAGbNwHB9EynVUOFVoDavuGrHH1g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793317029; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ynrlhjC6hj5xeRb9ATOAcgdzbffVa29su/ELbk2BOHI=; b=L+8XBtzdPuY+gsnigB7KjP1+ia7zwP2063dDCg8SzzaK1GSJKiSfnoGy09iZEANNBqgvAv ZERe96GgvHInKFo5qgRt65heb7n3yW4Tzb980x5wtW7/JwNq1do/elK58ugX8nJ7+gURCS 5WL1usm3yRVVE4shhya1lECger8wh1Ewat0CF9IHsuNizOLT1FUsxAQYAhg6X1OgRkebfs t4lwixJzNzuplXG/1YUdbWMmJojxhyCmU2AkdfCfUbJ6b02G0KdXYjMlNu6NzwIar0yOxk SlnTzL/526ChdK4czkDTEd8Z9Mf7LxHnx3T4eMRHbdgakLkRlP9/8kaEk4eQFg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jG0xx3nTFz12HT for ; Thu, 29 Oct 2026 23:37:09 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3b2ed by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 29 Oct 2026 23:37:09 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Sumit Saxena From: Kevin Bowling Subject: git: 9f632a70ffc8 - stable/15 - if_bnxt: Pass HWRM cmd response to apps even if FW fails it List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kbowling X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 9f632a70ffc82824ca7a440daae5f176c678382f Auto-Submitted: auto-generated Date: Thu, 29 Oct 2026 23:37:09 +0000 Message-Id: <6ae3d8a5.3b2ed.2596e040@gitrepo.freebsd.org> The branch stable/15 has been updated by kbowling: URL: https://cgit.FreeBSD.org/src/commit/?id=9f632a70ffc82824ca7a440daae5f176c678382f commit 9f632a70ffc82824ca7a440daae5f176c678382f Author: Sumit Saxena AuthorDate: 2026-07-31 15:48:07 +0000 Commit: Kevin Bowling CommitDate: 2026-10-29 23:15:18 +0000 if_bnxt: Pass HWRM cmd response to apps even if FW fails it The driver was not passing the HWRM command response to management apps when the firmware failed the command, which is not what apps expect. Copy the response out whenever firmware populated one (resp_len != 0), regardless of the command's overall return code, and stop bailing out of the mgmt ioctl path early on a failed passthrough so DMA'd indirect data and the response still get copied to userspace. Reviewed by: gallatin Sponsored by: Broadcom Inc. Differential Revision: https://reviews.freebsd.org/D58609 (cherry picked from commit 53b576bd81a4fb5c38b952e74ff2f806569bc8ac) --- sys/dev/bnxt/bnxt_en/bnxt_hwrm.c | 17 ++++++++++++++--- sys/dev/bnxt/bnxt_en/bnxt_mgmt.c | 16 ++++++++++++++-- 2 files changed, 28 insertions(+), 5 deletions(-) diff --git a/sys/dev/bnxt/bnxt_en/bnxt_hwrm.c b/sys/dev/bnxt/bnxt_en/bnxt_hwrm.c index a7a4422c4245..d1069dcf605c 100644 --- a/sys/dev/bnxt/bnxt_en/bnxt_hwrm.c +++ b/sys/dev/bnxt/bnxt_en/bnxt_hwrm.c @@ -865,7 +865,7 @@ bnxt_hwrm_passthrough(struct bnxt_softc *softc, void *req, uint32_t req_len, void *resp, uint32_t resp_len, uint32_t app_timeout) { int rc = 0; - void *output = (void *)softc->hwrm_cmd_resp.idi_vaddr; + struct hwrm_err_output *output = (void *)softc->hwrm_cmd_resp.idi_vaddr; struct input *input = req; uint32_t old_timeo; @@ -878,13 +878,24 @@ bnxt_hwrm_passthrough(struct bnxt_softc *softc, void *req, uint32_t req_len, softc->hwrm_cmd_timeo = max(app_timeout, softc->hwrm_cmd_timeo); rc = _hwrm_send_message(softc, req, req_len); softc->hwrm_cmd_timeo = old_timeo; + + /* + * On ETIMEDOUT the shared resp buffer may still hold a stale, unrelated + * response, so skip the copy; otherwise clamp to resp_len and PAGE_SIZE. + */ + if (rc != ETIMEDOUT) { + uint32_t copy_len = min(resp_len, output->resp_len); + + copy_len = min(copy_len, PAGE_SIZE); + if (copy_len) + memcpy(resp, output, copy_len); + } + if (rc) { device_printf(softc->dev, "%s: %s command failed with rc: 0x%x\n", __FUNCTION__, GET_HWRM_REQ_TYPE(input->req_type), rc); goto fail; } - - memcpy(resp, output, resp_len); fail: BNXT_HWRM_UNLOCK(softc); return rc; diff --git a/sys/dev/bnxt/bnxt_en/bnxt_mgmt.c b/sys/dev/bnxt/bnxt_en/bnxt_mgmt.c index edf50ac1432f..7a200df0fda4 100644 --- a/sys/dev/bnxt/bnxt_en/bnxt_mgmt.c +++ b/sys/dev/bnxt/bnxt_en/bnxt_mgmt.c @@ -592,6 +592,20 @@ bnxt_mgmt_process_hwrm(struct cdev *dev, u_long cmd, caddr_t data, ret = -EFAULT; goto end; } + + /* + * TOCTOU: this second copyin re-reads len_req/len_resp from + * userspace, so require them to match msg_temp's already-validated + * values to prevent overflowing the buffers sized from those. + */ + if (msg2->len_req != msg_temp.len_req || + msg2->len_resp != msg_temp.len_resp) { + device_printf(softc->dev, "%s:%d len_req/len_resp " + "mismatch on second copy\n", + __func__, __LINE__); + ret = -EINVAL; + goto end; + } msg = msg2; for (i = 0; i < num_ind; i++) { @@ -635,8 +649,6 @@ bnxt_mgmt_process_hwrm(struct cdev *dev, u_long cmd, caddr_t data, } ret = bnxt_hwrm_passthrough(softc, req, msg->len_req, resp, msg->len_resp, msg->timeout); - if (ret) - goto end; for (i = 0; i < num_ind; i++) { if ((msg->dma[i].read_or_write)) {