[PATCH] net/bnxt: add bounds checks for FW-supplied IDs

[Manish Kurup]

From: Joseph Wong <joseph.w...@broadcom.com>

In ulp_port_db_port_update(), firmware supplies IDs (drv_func_id,
vf_func_id, phy_port_id) which are used as array indices. Add
strict bounds checking to prevent out of bounds memory accesses.

Fixes: ad9eed0248ad ("net/bnxt: support flow template for Thor")
Fixes: 1993b267dbcb ("net/bnxt: cleanup ULP parser and mapper")
Fixes: ddaf0afae48a ("net/bnxt: refactor ULP mapper")
Cc: sta...@dpdk.org

Signed-off-by: Joseph Wong <joseph.w...@broadcom.com>
Signed-off-by: Manish Kurup <manish.ku...@broadcom.com>
---
 drivers/net/bnxt/tf_ulp/ulp_port_db.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/drivers/net/bnxt/tf_ulp/ulp_port_db.c 
b/drivers/net/bnxt/tf_ulp/ulp_port_db.c
index 6907771725..aad66fd8ab 100644
--- a/drivers/net/bnxt/tf_ulp/ulp_port_db.c
+++ b/drivers/net/bnxt/tf_ulp/ulp_port_db.c
@@ -159,6 +159,11 @@ int32_t    ulp_port_db_port_update(struct bnxt_ulp_context 
*ulp_ctxt,
        intf->drv_func_id = bnxt_pmd_get_fw_func_id(port_id,
                                                BNXT_ULP_INTF_TYPE_INVALID);
 
+       if (intf->drv_func_id >= BNXT_PORT_DB_MAX_FUNC) {
+               BNXT_DRV_DBG(ERR, "Invalid drv_func_id %d", intf->drv_func_id);
+               return -EINVAL;
+       }
+
        func = &port_db->ulp_func_id_tbl[intf->drv_func_id];
        if (!func->func_valid) {
                func->func_svif = bnxt_pmd_get_svif(port_id, true,
@@ -180,6 +185,11 @@ int32_t    ulp_port_db_port_update(struct bnxt_ulp_context 
*ulp_ctxt,
                intf->vf_func_id =
                        bnxt_pmd_get_fw_func_id(port_id, 
BNXT_ULP_INTF_TYPE_VF_REP);
 
+               if (intf->vf_func_id >= BNXT_PORT_DB_MAX_FUNC) {
+                       BNXT_DRV_DBG(ERR, "Invalid vf_func_id %d", 
intf->vf_func_id);
+                       return -EINVAL;
+               }
+
                func = &port_db->ulp_func_id_tbl[intf->vf_func_id];
                func->func_svif =
                        bnxt_pmd_get_svif(port_id, true, 
BNXT_ULP_INTF_TYPE_VF_REP);
@@ -206,6 +216,11 @@ int32_t    ulp_port_db_port_update(struct bnxt_ulp_context 
*ulp_ctxt,
        bnxt_pmd_get_iface_mac(port_id, intf->type, func->func_mac,
                           func->func_parent_mac);
 
+       if (func->phy_port_id >= port_db->phy_port_cnt) {
+               BNXT_DRV_DBG(ERR, "Invalid phy_port_id %d", func->phy_port_id);
+               return -EINVAL;
+       }
+
        port_data = &port_db->phy_port_list[func->phy_port_id];
        if (!port_data->port_valid) {
                port_data->port_svif =
-- 
2.31.1