[PATCH] net/bnxt: validate direction index in tpm tbl

[Manish Kurup]

From: Kishore Padmanabha <kishore.padmanabha at broadcom.com>

Validate the direction index during OEM data message processing so
that it cannot go out of bounds when setting or getting data from the
table-scope instance manager. Add a boundary check for the direction
input; the region input already had a bounds check.

Fixes: 80317ff6adfd ("net/bnxt/tf_core: support Thor2")
Cc: stable at dpdk.org

Signed-off-by: Kishore Padmanabha <kishore.padmanabha at broadcom.com>
---
 drivers/net/bnxt/hcapi/cfa_v3/tim/cfa_tim.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/net/bnxt/hcapi/cfa_v3/tim/cfa_tim.c b/drivers/net/bnxt/hcapi/cfa_v3/tim/cfa_tim.c
index 72302ac73b..6abed2ed2c 100644
--- a/drivers/net/bnxt/hcapi/cfa_v3/tim/cfa_tim.c
+++ b/drivers/net/bnxt/hcapi/cfa_v3/tim/cfa_tim.c
@@ -83,6 +83,11 @@ int cfa_tim_tpm_inst_set(void *tim, uint8_t tsid, uint8_t region_id,
 		return -EINVAL;
 	}
 
+	if (dir < 0 || dir >= CFA_DIR_MAX) {
+		CFA_LOG_ERR("dir = %d\n", dir);
+		return -EINVAL;
+	}
+
 	if (!(CFA_CHECK_UPPER_BOUNDS(tsid, ctx->max_tsid - 1) &&
 	      CFA_CHECK_UPPER_BOUNDS(region_id, ctx->max_regions - 1))) {
 		CFA_LOG_ERR("tsid = %d, region_id = %d\n", tsid, region_id);
@@ -105,6 +110,11 @@ int cfa_tim_tpm_inst_get(void *tim, uint8_t tsid, uint8_t region_id,
 		return -EINVAL;
 	}
 
+	if (dir < 0 || dir >= CFA_DIR_MAX) {
+		CFA_LOG_ERR("dir = %d\n", dir);
+		return -EINVAL;
+	}
+
 	if (!(CFA_CHECK_UPPER_BOUNDS(tsid, ctx->max_tsid - 1) &&
 	      CFA_CHECK_UPPER_BOUNDS(region_id, ctx->max_regions - 1))) {
 		CFA_LOG_ERR("tsid = %d, region_id = %d\n", tsid, region_id);
-- 
2.31.1