From: Joseph Wong <[email protected]>
In ulp_port_db_port_update(), firmware supplies IDs (drv_func_id,
vf_func_id, phy_port_id) which are used as array indices. Add
strict bounds checking to prevent out of bounds memory accesses.
Fixes: 45e8e1d406b7 ("net/bnxt: enhance port DB")
Cc: [email protected]
Signed-off-by: Joseph Wong <[email protected]>
Signed-off-by: Manish Kurup <[email protected]>
Signed-off-by: Mohammad Shuab Siddique <[email protected]>
---
v2:
- Fixes tag corrected to 45e8e1d406b7; the previous three tags did not
introduce the unchecked indexing
- Use %u for the unsigned values in the new log messages
- Check phy_port_id before the parent vnic and MAC address updates
drivers/net/bnxt/tf_ulp/ulp_port_db.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/drivers/net/bnxt/tf_ulp/ulp_port_db.c
b/drivers/net/bnxt/tf_ulp/ulp_port_db.c
index 69077717253..e41b9bf4b43 100644
--- a/drivers/net/bnxt/tf_ulp/ulp_port_db.c
+++ b/drivers/net/bnxt/tf_ulp/ulp_port_db.c
@@ -159,6 +159,11 @@ int32_t ulp_port_db_port_update(struct bnxt_ulp_context
*ulp_ctxt,
intf->drv_func_id = bnxt_pmd_get_fw_func_id(port_id,
BNXT_ULP_INTF_TYPE_INVALID);
+ if (intf->drv_func_id >= BNXT_PORT_DB_MAX_FUNC) {
+ BNXT_DRV_DBG(ERR, "Invalid drv_func_id %u", intf->drv_func_id);
+ return -EINVAL;
+ }
+
func = &port_db->ulp_func_id_tbl[intf->drv_func_id];
if (!func->func_valid) {
func->func_svif = bnxt_pmd_get_svif(port_id, true,
@@ -180,6 +185,11 @@ int32_t ulp_port_db_port_update(struct bnxt_ulp_context
*ulp_ctxt,
intf->vf_func_id =
bnxt_pmd_get_fw_func_id(port_id,
BNXT_ULP_INTF_TYPE_VF_REP);
+ if (intf->vf_func_id >= BNXT_PORT_DB_MAX_FUNC) {
+ BNXT_DRV_DBG(ERR, "Invalid vf_func_id %u",
intf->vf_func_id);
+ return -EINVAL;
+ }
+
func = &port_db->ulp_func_id_tbl[intf->vf_func_id];
func->func_svif =
bnxt_pmd_get_svif(port_id, true,
BNXT_ULP_INTF_TYPE_VF_REP);
@@ -198,6 +208,11 @@ int32_t ulp_port_db_port_update(struct bnxt_ulp_context
*ulp_ctxt,
func->table_scope = tsid;
}
+ if (func->phy_port_id >= port_db->phy_port_cnt) {
+ BNXT_DRV_DBG(ERR, "Invalid phy_port_id %u", func->phy_port_id);
+ return -EINVAL;
+ }
+
/* When there is no match, the default action is to send the packet to
* the kernel. And to send it to the kernel, we need the PF's vnic id.
*/
--
2.47.3
