[PATCH v2] net/bnxt: add bounds checks for FW-supplied IDs

[Mohammad Shuab Siddique]

From: Joseph Wong <joseph.wong at broadcom.com>

In ulp_port_db_port_update(), firmware supplies IDs (drv_func_id,
vf_func_id, phy_port_id) which are used as array indices. Add
strict bounds checking to prevent out of bounds memory accesses.

Fixes: 45e8e1d406b7 ("net/bnxt: enhance port DB")
Cc: stable at dpdk.org

Signed-off-by: Joseph Wong <joseph.wong at broadcom.com>
Signed-off-by: Manish Kurup <manish.kurup at broadcom.com>
Signed-off-by: Mohammad Shuab Siddique <mohammad-shuab.siddique at broadcom.com>
---
v2:
 - Fixes tag corrected to 45e8e1d406b7; the previous three tags did not introduce the unchecked indexing
 - Use %u for the unsigned values in the new log messages
 - Check phy_port_id before the parent vnic and MAC address updates

 drivers/net/bnxt/tf_ulp/ulp_port_db.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/drivers/net/bnxt/tf_ulp/ulp_port_db.c b/drivers/net/bnxt/tf_ulp/ulp_port_db.c
index 69077717253..e41b9bf4b43 100644
--- a/drivers/net/bnxt/tf_ulp/ulp_port_db.c
+++ b/drivers/net/bnxt/tf_ulp/ulp_port_db.c
@@ -159,6 +159,11 @@ int32_t	ulp_port_db_port_update(struct bnxt_ulp_context *ulp_ctxt,
 	intf->drv_func_id = bnxt_pmd_get_fw_func_id(port_id,
 						BNXT_ULP_INTF_TYPE_INVALID);
 
+	if (intf->drv_func_id >= BNXT_PORT_DB_MAX_FUNC) {
+		BNXT_DRV_DBG(ERR, "Invalid drv_func_id %u", intf->drv_func_id);
+		return -EINVAL;
+	}
+
 	func = &port_db->ulp_func_id_tbl[intf->drv_func_id];
 	if (!func->func_valid) {
 		func->func_svif = bnxt_pmd_get_svif(port_id, true,
@@ -180,6 +185,11 @@ int32_t	ulp_port_db_port_update(struct bnxt_ulp_context *ulp_ctxt,
 		intf->vf_func_id =
 			bnxt_pmd_get_fw_func_id(port_id, BNXT_ULP_INTF_TYPE_VF_REP);
 
+		if (intf->vf_func_id >= BNXT_PORT_DB_MAX_FUNC) {
+			BNXT_DRV_DBG(ERR, "Invalid vf_func_id %u", intf->vf_func_id);
+			return -EINVAL;
+		}
+
 		func = &port_db->ulp_func_id_tbl[intf->vf_func_id];
 		func->func_svif =
 			bnxt_pmd_get_svif(port_id, true, BNXT_ULP_INTF_TYPE_VF_REP);
@@ -198,6 +208,11 @@ int32_t	ulp_port_db_port_update(struct bnxt_ulp_context *ulp_ctxt,
 			func->table_scope = tsid;
 	}
 
+	if (func->phy_port_id >= port_db->phy_port_cnt) {
+		BNXT_DRV_DBG(ERR, "Invalid phy_port_id %u", func->phy_port_id);
+		return -EINVAL;
+	}
+
 	/* When there is no match, the default action is to send the packet to
 	 * the kernel. And to send it to the kernel, we need the PF's vnic id.
 	 */
-- 
2.47.3