[PATCH v2] net/bnxt: validate direction index in tpm tbl

[Mohammad Shuab Siddique]

From: Kishore Padmanabha <kishore.padmanabha at broadcom.com>

Validate the direction in cfa_tim_tpm_inst_set() and
cfa_tim_tpm_inst_get() so that a direction taken from a VF2PF
message cannot index past the table scope instance manager's TPM
table. The tsid and region inputs were already range checked.

Fixes: 80317ff6adfd ("net/bnxt/tf_core: support Thor2")
Cc: stable at dpdk.org

Signed-off-by: Kishore Padmanabha <kishore.padmanabha at broadcom.com>
Signed-off-by: Mohammad Shuab Siddique <mohammad-shuab.siddique at broadcom.com>
---
v2:
 - Reword the commit message to describe the change: the direction argument of cfa_tim_tpm_inst_set() and cfa_tim_tpm_inst_get() is validated
 - No code change

 drivers/net/bnxt/hcapi/cfa_v3/tim/cfa_tim.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/net/bnxt/hcapi/cfa_v3/tim/cfa_tim.c b/drivers/net/bnxt/hcapi/cfa_v3/tim/cfa_tim.c
index 72302ac73be..6abed2ed2ca 100644
--- a/drivers/net/bnxt/hcapi/cfa_v3/tim/cfa_tim.c
+++ b/drivers/net/bnxt/hcapi/cfa_v3/tim/cfa_tim.c
@@ -83,6 +83,11 @@ int cfa_tim_tpm_inst_set(void *tim, uint8_t tsid, uint8_t region_id,
 		return -EINVAL;
 	}
 
+	if (dir < 0 || dir >= CFA_DIR_MAX) {
+		CFA_LOG_ERR("dir = %d\n", dir);
+		return -EINVAL;
+	}
+
 	if (!(CFA_CHECK_UPPER_BOUNDS(tsid, ctx->max_tsid - 1) &&
 	      CFA_CHECK_UPPER_BOUNDS(region_id, ctx->max_regions - 1))) {
 		CFA_LOG_ERR("tsid = %d, region_id = %d\n", tsid, region_id);
@@ -105,6 +110,11 @@ int cfa_tim_tpm_inst_get(void *tim, uint8_t tsid, uint8_t region_id,
 		return -EINVAL;
 	}
 
+	if (dir < 0 || dir >= CFA_DIR_MAX) {
+		CFA_LOG_ERR("dir = %d\n", dir);
+		return -EINVAL;
+	}
+
 	if (!(CFA_CHECK_UPPER_BOUNDS(tsid, ctx->max_tsid - 1) &&
 	      CFA_CHECK_UPPER_BOUNDS(region_id, ctx->max_regions - 1))) {
 		CFA_LOG_ERR("tsid = %d, region_id = %d\n", tsid, region_id);
-- 
2.47.3