[PATCH] net/bnxt: add bounds checks for FW-supplied IDs

[PATCH] net/bnxt: add bounds checks for FW-supplied IDs

[Manish Kurup]

From: Joseph Wong <joseph.wong@broadcom.com>

In ulp_port_db_port_update(), firmware supplies IDs (drv_func_id,
vf_func_id, phy_port_id) which are used as array indices. Add
strict bounds checking to prevent out of bounds memory accesses.

Fixes: ad9eed0248ad ("net/bnxt: support flow template for Thor")
Fixes: 1993b267dbcb ("net/bnxt: cleanup ULP parser and mapper")
Fixes: ddaf0afae48a ("net/bnxt: refactor ULP mapper")
Cc: stable@dpdk.org

Signed-off-by: Joseph Wong <joseph.wong@broadcom.com>
Signed-off-by: Manish Kurup <manish.kurup@broadcom.com>
---
 drivers/net/bnxt/tf_ulp/ulp_port_db.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/drivers/net/bnxt/tf_ulp/ulp_port_db.c b/drivers/net/bnxt/tf_ulp/ulp_port_db.c
index 6907771725..aad66fd8ab 100644
--- a/drivers/net/bnxt/tf_ulp/ulp_port_db.c
+++ b/drivers/net/bnxt/tf_ulp/ulp_port_db.c
@@ -159,6 +159,11 @@ int32_t	ulp_port_db_port_update(struct bnxt_ulp_context *ulp_ctxt,
 	intf->drv_func_id = bnxt_pmd_get_fw_func_id(port_id,
 						BNXT_ULP_INTF_TYPE_INVALID);
 
+	if (intf->drv_func_id >= BNXT_PORT_DB_MAX_FUNC) {
+		BNXT_DRV_DBG(ERR, "Invalid drv_func_id %d", intf->drv_func_id);
+		return -EINVAL;
+	}
+
 	func = &port_db->ulp_func_id_tbl[intf->drv_func_id];
 	if (!func->func_valid) {
 		func->func_svif = bnxt_pmd_get_svif(port_id, true,
@@ -180,6 +185,11 @@ int32_t	ulp_port_db_port_update(struct bnxt_ulp_context *ulp_ctxt,
 		intf->vf_func_id =
 			bnxt_pmd_get_fw_func_id(port_id, BNXT_ULP_INTF_TYPE_VF_REP);
 
+		if (intf->vf_func_id >= BNXT_PORT_DB_MAX_FUNC) {
+			BNXT_DRV_DBG(ERR, "Invalid vf_func_id %d", intf->vf_func_id);
+			return -EINVAL;
+		}
+
 		func = &port_db->ulp_func_id_tbl[intf->vf_func_id];
 		func->func_svif =
 			bnxt_pmd_get_svif(port_id, true, BNXT_ULP_INTF_TYPE_VF_REP);
@@ -206,6 +216,11 @@ int32_t	ulp_port_db_port_update(struct bnxt_ulp_context *ulp_ctxt,
 	bnxt_pmd_get_iface_mac(port_id, intf->type, func->func_mac,
 			   func->func_parent_mac);
 
+	if (func->phy_port_id >= port_db->phy_port_cnt) {
+		BNXT_DRV_DBG(ERR, "Invalid phy_port_id %d", func->phy_port_id);
+		return -EINVAL;
+	}
+
 	port_data = &port_db->phy_port_list[func->phy_port_id];
 	if (!port_data->port_valid) {
 		port_data->port_svif =
-- 
2.31.1