[PATCH 0/2] net/bnxt: fix message layer and hot-upgrade issues

[Manish Kurup <manish.kurup@broadcom.com>]

This series fixes several bounds/pointer issues found by static
analysis in the tf_core message layer, plus a related validation
limit bug found while fixing them:

- Patch 1 caps a memcpy() to the caller's buffer size in
  tfc_msg_idx_tbl_get(), adds a NULL check on that function's
  caller-supplied dev_data/data_size pointers, fixes a fall-through
  in tfc_msg_if_tbl_get() that let a size-mismatch error still copy
  oversized data, and adds missing NULL checks on a caller-supplied
  pointer in tfc_msg_idx_tbl_alloc_set()/tfc_msg_idx_tbl_set().

- Patch 2 fixes the app-instance-ID validation limit used during
  hot-upgrade: it enforced a limit of 4 (the number of concurrent
  instances) instead of 8 (the actual valid ID range), incorrectly
  rejecting valid instance IDs 5-8.

Manish Kurup (1):
  net/bnxt: fix hot-upgrade app instance ID limit

Mohammad Shuab Siddique (1):
  net/bnxt: fix message-layer bounds and pointer checks

 .../bnxt/hcapi/cfa_v3/include/cfa_resources.h |  2 +-
 drivers/net/bnxt/tf_core/v3/tfc_msg.c         | 32 ++++++++++++++++---
 2 files changed, 29 insertions(+), 5 deletions(-)

-- 
2.31.1