This series fixes several bounds/pointer issues found by static analysis in the tf_core message layer, plus a related validation limit bug found while fixing them:
- Patch 1 caps a memcpy() to the caller's buffer size in tfc_msg_idx_tbl_get(), adds a NULL check on that function's caller-supplied dev_data/data_size pointers, fixes a fall-through in tfc_msg_if_tbl_get() that let a size-mismatch error still copy oversized data, and adds missing NULL checks on a caller-supplied pointer in tfc_msg_idx_tbl_alloc_set()/tfc_msg_idx_tbl_set(). - Patch 2 fixes the app-instance-ID validation limit used during hot-upgrade: it enforced a limit of 4 (the number of concurrent instances) instead of 8 (the actual valid ID range), incorrectly rejecting valid instance IDs 5-8. Manish Kurup (1): net/bnxt: fix hot-upgrade app instance ID limit Mohammad Shuab Siddique (1): net/bnxt: fix message-layer bounds and pointer checks .../bnxt/hcapi/cfa_v3/include/cfa_resources.h | 2 +- drivers/net/bnxt/tf_core/v3/tfc_msg.c | 32 ++++++++++++++++--- 2 files changed, 29 insertions(+), 5 deletions(-) -- 2.31.1
