From nobody Fri Oct 09 10:12:44 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j1N312W64z6vRK6 for ; Fri, 09 Oct 2026 10:12:45 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4j1N3063ttz4Y22 for ; Fri, 09 Oct 2026 10:12:44 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791540764; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=knyY9gnaUfuG7A/LcgO6H8JAJA/ekOHqmgBx4IdmtUs=; b=gi7dzzFpDHvxaXtRsctF9IfdNHZ5T6BPbo18F9qHaCfMMQVxZsATUGGZU64lbhc3IUtgGj DlwDxdaNxofmtseh2MMQyWYAvR50aqvU8vRBA7Alrrv7SxZS8cGz+fGBABC4RvqcTTxj5j ZGxpZRDkC2eyqePiffvVaaupwHW+kn6R0T3SK5NADkqRn82SbkrXGgyGACWxPO3J3hs6I0 KMycA5C6TuSrT+RtYhULLXm+VkqZmO46oASPgRgmn29J0rZR4hH4reFLrbvyBsFQInZccq 2Zepxu5hiN0AT1cNtWS0wniWaKQXNvqyPzBf/cUp4Zjlwwkx5Q1dDg4RrPeUGQ== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791540764; b=VE6NrlkKc9HVIXwQmeSukwROtEfdLCnRhhYJ9X/3MZApMrCj7YvQM8mii3rWY2MHVMKArp oYWY7OJjY3JJaMZepn2oLMO2sYV5qcDMLIFLGKhLUwlCiiFkwQEaThPge1TEAPAFS3T/n5 P1+SmZrpDdsR1AihmpBlHGYUWdftq9qwpQBa8OGfkVyYORZn9rRgiUEyawaRuPBI4rPgdm OHQ4DvibHUVwyNfQiUKUMNtEgAYdNuCQ+E7Nr2IVJh2qN6FWoBPylpNAm1t7Edsmr9xIOM fqEE1WabicXOP/lYNz0QAW7BHl+qBy7VmRKD0kDDONK+tlQRLOVH4L5sd789TQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791540764; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=knyY9gnaUfuG7A/LcgO6H8JAJA/ekOHqmgBx4IdmtUs=; b=dcPt/9LgNlcvYaUqCucfTpFb58YfnK80FQJnKH1cm5TaLXDejoVhVtfqtohcSt9/SyvlU0 Z6cqE/5jrqfrm+RsvFnQ9rK1M1O1SU98w3s4YuXRTtAtpfIO858L1K9TYCmVXDSrdOiF2I r0Lt+bxzYPWZ1p1unSDAInc+x431pCjH5aOAOJHjzv5cKkmdu4HISA28QKIpwun1goXiKX 97yXrYAn9YMZwpbvKQT6rq4Rs8m7jTjmi8HDj3dA1TpgliO06FuA5Up57KXS5LNPRc0MvX NBwJ1mHrBgfzPyJOWIsKUCyb3o/zexoaCbmGMH/utwOjgQG+9ETVNQcK03vtXA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j1N304wwGz1LWr for ; Fri, 09 Oct 2026 10:12:44 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 43a86 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 09 Oct 2026 10:12:44 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: Sumit Saxena From: Sumit Saxena Subject: git: 53b576bd81a4 - main - if_bnxt: Pass HWRM cmd response to apps even if FW fails it List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: ssaxena X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 53b576bd81a4fb5c38b952e74ff2f806569bc8ac Auto-Submitted: auto-generated Date: Fri, 09 Oct 2026 10:12:44 +0000 Message-Id: <6ac8be1c.43a86.267ed914@gitrepo.freebsd.org> The branch main has been updated by ssaxena: URL: https://cgit.FreeBSD.org/src/commit/?id=53b576bd81a4fb5c38b952e74ff2f806569bc8ac commit 53b576bd81a4fb5c38b952e74ff2f806569bc8ac Author: Sumit Saxena AuthorDate: 2026-07-31 15:48:07 +0000 Commit: Sumit Saxena CommitDate: 2026-10-09 08:24:44 +0000 if_bnxt: Pass HWRM cmd response to apps even if FW fails it The driver was not passing the HWRM command response to management apps when the firmware failed the command, which is not what apps expect. Copy the response out whenever firmware populated one (resp_len != 0), regardless of the command's overall return code, and stop bailing out of the mgmt ioctl path early on a failed passthrough so DMA'd indirect data and the response still get copied to userspace. Reviewed by: gallatin MFC after: 2 weeks Sponsored by: Broadcom Inc. Differential Revision: https://reviews.freebsd.org/D58609 --- sys/dev/bnxt/bnxt_en/bnxt_hwrm.c | 17 ++++++++++++++--- sys/dev/bnxt/bnxt_en/bnxt_mgmt.c | 16 ++++++++++++++-- 2 files changed, 28 insertions(+), 5 deletions(-) diff --git a/sys/dev/bnxt/bnxt_en/bnxt_hwrm.c b/sys/dev/bnxt/bnxt_en/bnxt_hwrm.c index 57af44ec38c5..680bb593c4b4 100644 --- a/sys/dev/bnxt/bnxt_en/bnxt_hwrm.c +++ b/sys/dev/bnxt/bnxt_en/bnxt_hwrm.c @@ -876,7 +876,7 @@ bnxt_hwrm_passthrough(struct bnxt_softc *softc, void *req, uint32_t req_len, void *resp, uint32_t resp_len, uint32_t app_timeout) { int rc = 0; - void *output = (void *)softc->hwrm_cmd_resp.idi_vaddr; + struct hwrm_err_output *output = (void *)softc->hwrm_cmd_resp.idi_vaddr; struct input *input = req; uint32_t old_timeo; @@ -889,13 +889,24 @@ bnxt_hwrm_passthrough(struct bnxt_softc *softc, void *req, uint32_t req_len, softc->hwrm_cmd_timeo = max(app_timeout, softc->hwrm_cmd_timeo); rc = _hwrm_send_message(softc, req, req_len); softc->hwrm_cmd_timeo = old_timeo; + + /* + * On ETIMEDOUT the shared resp buffer may still hold a stale, unrelated + * response, so skip the copy; otherwise clamp to resp_len and PAGE_SIZE. + */ + if (rc != ETIMEDOUT) { + uint32_t copy_len = min(resp_len, output->resp_len); + + copy_len = min(copy_len, PAGE_SIZE); + if (copy_len) + memcpy(resp, output, copy_len); + } + if (rc) { device_printf(softc->dev, "%s: %s command failed with rc: 0x%x\n", __FUNCTION__, GET_HWRM_REQ_TYPE(input->req_type), rc); goto fail; } - - memcpy(resp, output, resp_len); fail: BNXT_HWRM_UNLOCK(softc); return rc; diff --git a/sys/dev/bnxt/bnxt_en/bnxt_mgmt.c b/sys/dev/bnxt/bnxt_en/bnxt_mgmt.c index edf50ac1432f..7a200df0fda4 100644 --- a/sys/dev/bnxt/bnxt_en/bnxt_mgmt.c +++ b/sys/dev/bnxt/bnxt_en/bnxt_mgmt.c @@ -592,6 +592,20 @@ bnxt_mgmt_process_hwrm(struct cdev *dev, u_long cmd, caddr_t data, ret = -EFAULT; goto end; } + + /* + * TOCTOU: this second copyin re-reads len_req/len_resp from + * userspace, so require them to match msg_temp's already-validated + * values to prevent overflowing the buffers sized from those. + */ + if (msg2->len_req != msg_temp.len_req || + msg2->len_resp != msg_temp.len_resp) { + device_printf(softc->dev, "%s:%d len_req/len_resp " + "mismatch on second copy\n", + __func__, __LINE__); + ret = -EINVAL; + goto end; + } msg = msg2; for (i = 0; i < num_ind; i++) { @@ -635,8 +649,6 @@ bnxt_mgmt_process_hwrm(struct cdev *dev, u_long cmd, caddr_t data, } ret = bnxt_hwrm_passthrough(softc, req, msg->len_req, resp, msg->len_resp, msg->timeout); - if (ret) - goto end; for (i = 0; i < num_ind; i++) { if ((msg->dma[i].read_or_write)) {