From: Kishore Padmanabha <[email protected]>
Validate the direction in cfa_tim_tpm_inst_set() and
cfa_tim_tpm_inst_get() so that a direction taken from a VF2PF
message cannot index past the table scope instance manager's TPM
table. The tsid and region inputs were already range checked.
Fixes: 80317ff6adfd ("net/bnxt/tf_core: support Thor2")
Cc: [email protected]
Signed-off-by: Kishore Padmanabha <[email protected]>
Signed-off-by: Mohammad Shuab Siddique <[email protected]>
---
v2:
- Reword the commit message to describe the change: the direction argument of
cfa_tim_tpm_inst_set() and cfa_tim_tpm_inst_get() is validated
- No code change
drivers/net/bnxt/hcapi/cfa_v3/tim/cfa_tim.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/net/bnxt/hcapi/cfa_v3/tim/cfa_tim.c
b/drivers/net/bnxt/hcapi/cfa_v3/tim/cfa_tim.c
index 72302ac73be..6abed2ed2ca 100644
--- a/drivers/net/bnxt/hcapi/cfa_v3/tim/cfa_tim.c
+++ b/drivers/net/bnxt/hcapi/cfa_v3/tim/cfa_tim.c
@@ -83,6 +83,11 @@ int cfa_tim_tpm_inst_set(void *tim, uint8_t tsid, uint8_t
region_id,
return -EINVAL;
}
+ if (dir < 0 || dir >= CFA_DIR_MAX) {
+ CFA_LOG_ERR("dir = %d\n", dir);
+ return -EINVAL;
+ }
+
if (!(CFA_CHECK_UPPER_BOUNDS(tsid, ctx->max_tsid - 1) &&
CFA_CHECK_UPPER_BOUNDS(region_id, ctx->max_regions - 1))) {
CFA_LOG_ERR("tsid = %d, region_id = %d\n", tsid, region_id);
@@ -105,6 +110,11 @@ int cfa_tim_tpm_inst_get(void *tim, uint8_t tsid, uint8_t
region_id,
return -EINVAL;
}
+ if (dir < 0 || dir >= CFA_DIR_MAX) {
+ CFA_LOG_ERR("dir = %d\n", dir);
+ return -EINVAL;
+ }
+
if (!(CFA_CHECK_UPPER_BOUNDS(tsid, ctx->max_tsid - 1) &&
CFA_CHECK_UPPER_BOUNDS(region_id, ctx->max_regions - 1))) {
CFA_LOG_ERR("tsid = %d, region_id = %d\n", tsid, region_id);
--
2.47.3
