From: Kishore Padmanabha <[email protected]>
Validate the direction index during OEM data message processing so
that it cannot go out of bounds when setting or getting data from the
table-scope instance manager. Add a boundary check for the direction
input; the region input already had a bounds check.
Fixes: 80317ff6adfd ("net/bnxt/tf_core: support Thor2")
Cc: [email protected]
Signed-off-by: Kishore Padmanabha <[email protected]>
---
drivers/net/bnxt/hcapi/cfa_v3/tim/cfa_tim.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/net/bnxt/hcapi/cfa_v3/tim/cfa_tim.c
b/drivers/net/bnxt/hcapi/cfa_v3/tim/cfa_tim.c
index 72302ac73b..6abed2ed2c 100644
--- a/drivers/net/bnxt/hcapi/cfa_v3/tim/cfa_tim.c
+++ b/drivers/net/bnxt/hcapi/cfa_v3/tim/cfa_tim.c
@@ -83,6 +83,11 @@ int cfa_tim_tpm_inst_set(void *tim, uint8_t tsid, uint8_t
region_id,
return -EINVAL;
}
+ if (dir < 0 || dir >= CFA_DIR_MAX) {
+ CFA_LOG_ERR("dir = %d\n", dir);
+ return -EINVAL;
+ }
+
if (!(CFA_CHECK_UPPER_BOUNDS(tsid, ctx->max_tsid - 1) &&
CFA_CHECK_UPPER_BOUNDS(region_id, ctx->max_regions - 1))) {
CFA_LOG_ERR("tsid = %d, region_id = %d\n", tsid, region_id);
@@ -105,6 +110,11 @@ int cfa_tim_tpm_inst_get(void *tim, uint8_t tsid, uint8_t
region_id,
return -EINVAL;
}
+ if (dir < 0 || dir >= CFA_DIR_MAX) {
+ CFA_LOG_ERR("dir = %d\n", dir);
+ return -EINVAL;
+ }
+
if (!(CFA_CHECK_UPPER_BOUNDS(tsid, ctx->max_tsid - 1) &&
CFA_CHECK_UPPER_BOUNDS(region_id, ctx->max_regions - 1))) {
CFA_LOG_ERR("tsid = %d, region_id = %d\n", tsid, region_id);
--
2.31.1
