[PATCH v2] net/bnxt/tf_core: validate TCAM entry get response

[Manish Kurup]

tf_msg_tcam_entry_get() copies the TCAM key, mask and result out of
the firmware response using the key_size, result_offset and
result_size values returned in the response, without checking them
against the size of the dev_data[] array they index. The mask is
read from dev_data[key_size] for key_size bytes and the result from
dev_data[result_offset] for result_size bytes, so a bad value
makes the copy read past the end of the 272 byte array in the
response on the stack.

Reject the response with -EINVAL if the key and mask (2 * key_size)
or the result (result_offset + result_size) do not fit in dev_data[].

Fixes: a9597be79f66 ("net/bnxt: support L2 context TCAM operations")
Cc: stable at dpdk.org

Signed-off-by: Manish Kurup <manish.kurup at broadcom.com>
---
v2:
* Split out of "net/bnxt: fix multiple truflow defects" (one fix per
  patch); this is the tf_msg_tcam_entry_get() response check.
* New subject and commit message; single Fixes: tag.

 drivers/net/bnxt/tf_core/tf_msg.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/net/bnxt/tf_core/tf_msg.c b/drivers/net/bnxt/tf_core/tf_msg.c
index aab8d05d81..c345d0a7ce 100644
--- a/drivers/net/bnxt/tf_core/tf_msg.c
+++ b/drivers/net/bnxt/tf_core/tf_msg.c
@@ -1243,6 +1243,16 @@ tf_msg_tcam_entry_get(struct tf *tfp,
 			    strerror(-rc));
 		return rc;
 	}
+	if (resp.key_size * 2 > sizeof(resp.dev_data) ||
+	    resp.result_offset + resp.result_size > sizeof(resp.dev_data)) {
+		rc = -EINVAL;
+		TFP_DRV_LOG(ERR,
+			    "%s: FW data out of bounds key_size(%d) result_offset(%d) result_size(%d), rc:%s\n",
+			    tf_dir_2_str(parms->dir), resp.key_size,
+			    resp.result_offset, resp.result_size,
+			    strerror(-rc));
+		return rc;
+	}
 	parms->key_size = resp.key_size;
 	parms->result_size = resp.result_size;
 	tfp_memcpy(parms->key, resp.dev_data, resp.key_size);
-- 
2.31.1