[PATCH net 0/5] eth: fix bugs in ntuple filter reporting

Looking thru some reports prompted by:
  Add new way to add BPF LSM hooks
  https://lore.kernel.org/20260831110934.241898-1-a.s.protopopov@gmail.com (local)

I/Claude noticed 3 drivers with buggy n-tuple filter dump. PoC built
based on intentionally adding the same bug in fbnic under QEMU confirms:

    # install 8 rules (this part does need CAP_NET_ADMIN)
    for p in 100 101 102 103 104 105 106 107; do
            ethtool -N eth0 flow-type tcp4 dst-port $p action 0
    done

    # Python
    SIOCETHTOOL = 0x8946
    ETHTOOL_GRXCLSRLALL = 0x30
    RXNFC_SIZE = 192          # sizeof(struct ethtool_rxnfc)
    RULE_CNT_OFF = 184        # offsetof(struct ethtool_rxnfc, rule_cnt)

    buf = array.array('B', bytes(RXNFC_SIZE + 4096))
    struct.pack_into('=I', buf, 0, ETHTOOL_GRXCLSRLALL)
    struct.pack_into('=I', buf, RULE_CNT_OFF, 1)   # room for one location

    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    ifr = struct.pack('16sP', b'eth0', buf.buffer_info()[0])
    fcntl.ioctl(sock, SIOCETHTOOL, ifr)

  ==================================================================
  BUG: KASAN: slab-out-of-bounds in fbnic_get_rxnfc+0x144d/0x1910
  Write of size 4 at addr ff11000007522be4 by task python3.12/647

Fix the 3 drivers, add a hopefully clearer mention in the doc.

Note that Sashiko will likely complain about mv88e6xxx letting
user read and delete rules from any port with ant netdev.
We can fix that in net-next, if mv88e6xxx experts can confirm that
the current behavior is not intentional (it's wrong but users may
now depend on it).

Jakub Kicinski (5):
  net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size
  eth: nfp: bound the ntuple rule dump by the caller's buffer size
  eth: nfp: drop the replaced rule from the list when reprogramming
    fails
  net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer
    size
  ethtool: document that GRXCLSRLALL rule_cnt is a caller-provided limit

 include/linux/ethtool.h                       |  6 ++++++
 drivers/net/dsa/bcm_sf2_cfp.c                 |  2 ++
 drivers/net/dsa/mv88e6xxx/chip.c              | 16 ++++++++++++----
 .../ethernet/netronome/nfp/nfp_net_ethtool.c  | 19 +++++++++++++++----
 4 files changed, 35 insertions(+), 8 deletions(-)

-- 
2.55.0