[PATCH] net/bnxt: fix bit allocator out of bounds read

[Manish Kurup]

From: Joseph Wong <joseph.wong at broadcom.com>

In ulp_bit_alloc_list_alloc(), the loop condition could allow the
index to reach bsize_64 before the bounds check ran (the do-while
body reads blist->bdata[idx++] before the loop condition tests
idx <= bsize_64), causing an out-of-bounds read one element past
the array. Refactor the loop to check the bound before indexing.

Fixes: 0001cc58d362 ("net/bnxt: support generic hash table")
Cc: stable at dpdk.org

Signed-off-by: Joseph Wong <joseph.wong at broadcom.com>
Signed-off-by: Manish Kurup <manish.kurup at broadcom.com>
---
 .mailmap                               |  1 +
 drivers/net/bnxt/tf_ulp/ulp_gen_hash.c | 17 ++++++++---------
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/.mailmap b/.mailmap
index 2e348c3bce..e013a7d6ba 100644
--- a/.mailmap
+++ b/.mailmap
@@ -813,6 +813,7 @@ Jonathan Tsai <jonathan1.tsai at intel.com>
 Joongi Kim <joongi at an.kaist.ac.kr>
 Jörg Thalheim <joerg at thalheim.io>
 Joseph Richard <joseph.richard at windriver.com>
+Joseph Wong <joseph.wong at broadcom.com>
 Josh Soref <jsoref at gmail.com>
 Joshua Hay <joshua.a.hay at intel.com>
 Joshua Washington <joshwash at google.com>
diff --git a/drivers/net/bnxt/tf_ulp/ulp_gen_hash.c b/drivers/net/bnxt/tf_ulp/ulp_gen_hash.c
index 74cdd5c1da..d94b59286f 100644
--- a/drivers/net/bnxt/tf_ulp/ulp_gen_hash.c
+++ b/drivers/net/bnxt/tf_ulp/ulp_gen_hash.c
@@ -21,16 +21,15 @@ int32_t ulp_bit_alloc_list_alloc(struct bit_alloc_list *blist,
 	uint32_t bsize_64 = blist->bsize / ULP_64B_IN_BYTES;
 
 	/* Iterate all numbers that have all 1's */
-	do {
-		bentry = blist->bdata[idx++];
-	} while (bentry == -1UL && idx <= bsize_64);
-
-	if (idx <= bsize_64) {
-		if (bentry)
+	while (idx < bsize_64) {
+		bentry = blist->bdata[idx];
+		if (bentry != -1UL) {
 			jdx = rte_clz64(~bentry);
-		*index = ((idx - 1) * ULP_INDEX_BITMAP_SIZE) + jdx;
-		ULP_INDEX_BITMAP_SET(blist->bdata[(idx - 1)], jdx);
-		return 0;
+			*index = (idx * ULP_INDEX_BITMAP_SIZE) + jdx;
+			ULP_INDEX_BITMAP_SET(blist->bdata[idx], jdx);
+			return 0;
+		}
+		idx++;
 	}
 	jdx = (uint32_t)(bsize_64 * ULP_INDEX_BITMAP_SIZE);
 	BNXT_DRV_DBG(ERR, "bit allocator is full reached max:%d\n", jdx);
-- 
2.31.1