net/bnxt: fix out of bound access in bit handling

[dpdk.git] / drivers / net / bnxt / tf_core / tf_rm.c

diff --git a/drivers/net/bnxt/tf_core/tf_rm.c b/drivers/net/bnxt/tf_core/tf_rm.c
index e7af9eb..66a3358 100644 (file)
--- a/drivers/net/bnxt/tf_core/tf_rm.c
+++ b/drivers/net/bnxt/tf_core/tf_rm.c
@@ -17,6 +17,9 @@
 #include "tfp.h"
 #include "tf_msg.h"
 
+/* Logging defines */
+#define TF_RM_DEBUG  0
+
 /**
  * Generic RM Element data type that an RM DB is build upon.
  */
@@ -120,16 +123,11 @@ tf_rm_count_hcapi_reservations(enum tf_dir dir,
                    cfg[i].cfg_type == TF_RM_ELEM_CFG_NULL &&
                    reservations[i] > 0) {
                        TFP_DRV_LOG(ERR,
-                               "%s, %s, %s allocation not supported\n",
-                               tf_device_module_type_2_str(type),
-                               tf_dir_2_str(dir),
-                               tf_device_module_type_subtype_2_str(type, i));
-                       printf("%s, %s, %s allocation of %d not supported\n",
+                               "%s, %s, %s allocation of %d not supported\n",
                                tf_device_module_type_2_str(type),
                                tf_dir_2_str(dir),
-                              tf_device_module_type_subtype_2_str(type, i),
-                              reservations[i]);
-
+                               tf_device_module_type_subtype_2_str(type, i),
+                               reservations[i]);
                }
        }
 
@@ -391,7 +389,7 @@ tf_rm_create_db(struct tf *tfp,
        TF_CHECK_PARMS2(tfp, parms);
 
        /* Retrieve the session information */
-       rc = tf_session_get_session(tfp, &tfs);
+       rc = tf_session_get_session_internal(tfp, &tfs);
        if (rc)
                return rc;
 
@@ -549,11 +547,6 @@ tf_rm_create_db(struct tf *tfp,
                        db[i].alloc.entry.start = resv[j].start;
                        db[i].alloc.entry.stride = resv[j].stride;
 
-                       printf("Entry:%d Start:%d Stride:%d\n",
-                              i,
-                              resv[j].start,
-                              resv[j].stride);
-
                        /* Only allocate BA pool if so requested */
                        if (parms->cfg[i].cfg_type == TF_RM_ELEM_CFG_HCAPI_BA) {
                                /* Create pool */
@@ -603,10 +596,12 @@ tf_rm_create_db(struct tf *tfp,
        rm_db->type = parms->type;
        *parms->rm_db = (void *)rm_db;
 
+#if (TF_RM_DEBUG == 1)
        printf("%s: type:%d num_entries:%d\n",
               tf_dir_2_str(parms->dir),
               parms->type,
               i);
+#endif /* (TF_RM_DEBUG == 1) */
 
        tfp_free((void *)req);
        tfp_free((void *)resv);
@@ -711,6 +706,8 @@ tf_rm_allocate(struct tf_rm_allocate_parms *parms)
        TF_CHECK_PARMS2(parms, parms->rm_db);
 
        rm_db = (struct tf_rm_new_db *)parms->rm_db;
+       if (!rm_db->db)
+               return -EINVAL;
        cfg_type = rm_db->db[parms->db_index].cfg_type;
 
        /* Bail out if not controlled by RM */
@@ -760,6 +757,8 @@ tf_rm_allocate(struct tf_rm_allocate_parms *parms)
        }
 
        *parms->index = index;
+       if (parms->base_index)
+               *parms->base_index = id;
 
        return rc;
 }
@@ -775,6 +774,8 @@ tf_rm_free(struct tf_rm_free_parms *parms)
        TF_CHECK_PARMS2(parms, parms->rm_db);
 
        rm_db = (struct tf_rm_new_db *)parms->rm_db;
+       if (!rm_db->db)
+               return -EINVAL;
        cfg_type = rm_db->db[parms->db_index].cfg_type;
 
        /* Bail out if not controlled by RM */
@@ -820,6 +821,8 @@ tf_rm_is_allocated(struct tf_rm_is_allocated_parms *parms)
        TF_CHECK_PARMS2(parms, parms->rm_db);
 
        rm_db = (struct tf_rm_new_db *)parms->rm_db;
+       if (!rm_db->db)
+               return -EINVAL;
        cfg_type = rm_db->db[parms->db_index].cfg_type;
 
        /* Bail out if not controlled by RM */
@@ -846,6 +849,8 @@ tf_rm_is_allocated(struct tf_rm_is_allocated_parms *parms)
        if (rc)
                return rc;
 
+       if (parms->base_index)
+               *parms->base_index = adj_index;
        *parms->allocated = ba_inuse(rm_db->db[parms->db_index].pool,
                                     adj_index);
 
@@ -861,6 +866,8 @@ tf_rm_get_info(struct tf_rm_get_alloc_info_parms *parms)
        TF_CHECK_PARMS2(parms, parms->rm_db);
 
        rm_db = (struct tf_rm_new_db *)parms->rm_db;
+       if (!rm_db->db)
+               return -EINVAL;
        cfg_type = rm_db->db[parms->db_index].cfg_type;
 
        /* Bail out if not controlled by HCAPI */
@@ -884,6 +891,8 @@ tf_rm_get_hcapi_type(struct tf_rm_get_hcapi_parms *parms)
        TF_CHECK_PARMS2(parms, parms->rm_db);
 
        rm_db = (struct tf_rm_new_db *)parms->rm_db;
+       if (!rm_db->db)
+               return -EINVAL;
        cfg_type = rm_db->db[parms->db_index].cfg_type;
 
        /* Bail out if not controlled by HCAPI */
@@ -906,6 +915,8 @@ tf_rm_get_inuse_count(struct tf_rm_get_inuse_count_parms *parms)
        TF_CHECK_PARMS2(parms, parms->rm_db);
 
        rm_db = (struct tf_rm_new_db *)parms->rm_db;
+       if (!rm_db->db)
+               return -EINVAL;
        cfg_type = rm_db->db[parms->db_index].cfg_type;
 
        /* Bail out if not controlled by RM */
@@ -925,3 +936,44 @@ tf_rm_get_inuse_count(struct tf_rm_get_inuse_count_parms *parms)
        return rc;
 
 }
+
+int
+tf_rm_check_indexes_in_range(struct tf_rm_check_indexes_in_range_parms *parms)
+{
+       struct tf_rm_new_db *rm_db;
+       enum tf_rm_elem_cfg_type cfg_type;
+       uint32_t base_index;
+       uint32_t stride;
+       int rc = 0;
+
+       TF_CHECK_PARMS2(parms, parms->rm_db);
+
+       rm_db = (struct tf_rm_new_db *)parms->rm_db;
+       if (!rm_db->db)
+               return -EINVAL;
+       cfg_type = rm_db->db[parms->db_index].cfg_type;
+
+       /* Bail out if not controlled by RM */
+       if (cfg_type != TF_RM_ELEM_CFG_HCAPI_BA)
+               return -ENOTSUP;
+
+       /* Bail out if the pool is not valid, should never happen */
+       if (rm_db->db[parms->db_index].pool == NULL) {
+               rc = -ENOTSUP;
+               TFP_DRV_LOG(ERR,
+                           "%s: Invalid pool for this type:%d, rc:%s\n",
+                           tf_dir_2_str(rm_db->dir),
+                           parms->db_index,
+                           strerror(-rc));
+               return rc;
+       }
+
+       base_index = rm_db->db[parms->db_index].alloc.entry.start;
+       stride = rm_db->db[parms->db_index].alloc.entry.stride;
+
+       if (parms->starting_index < base_index ||
+           parms->starting_index + parms->num_entries > base_index + stride)
+               return -EINVAL;
+
+       return rc;
+}