net/bnxt: fix out of bound access in bit handling

[dpdk.git] / drivers / net / bnxt / tf_core / tf_rm.c

diff --git a/drivers/net/bnxt/tf_core/tf_rm.c b/drivers/net/bnxt/tf_core/tf_rm.c
index fdb87ec..66a3358 100644 (file)
--- a/drivers/net/bnxt/tf_core/tf_rm.c
+++ b/drivers/net/bnxt/tf_core/tf_rm.c
@@ -706,6 +706,8 @@ tf_rm_allocate(struct tf_rm_allocate_parms *parms)
        TF_CHECK_PARMS2(parms, parms->rm_db);
 
        rm_db = (struct tf_rm_new_db *)parms->rm_db;
+       if (!rm_db->db)
+               return -EINVAL;
        cfg_type = rm_db->db[parms->db_index].cfg_type;
 
        /* Bail out if not controlled by RM */
@@ -755,6 +757,8 @@ tf_rm_allocate(struct tf_rm_allocate_parms *parms)
        }
 
        *parms->index = index;
+       if (parms->base_index)
+               *parms->base_index = id;
 
        return rc;
 }
@@ -770,6 +774,8 @@ tf_rm_free(struct tf_rm_free_parms *parms)
        TF_CHECK_PARMS2(parms, parms->rm_db);
 
        rm_db = (struct tf_rm_new_db *)parms->rm_db;
+       if (!rm_db->db)
+               return -EINVAL;
        cfg_type = rm_db->db[parms->db_index].cfg_type;
 
        /* Bail out if not controlled by RM */
@@ -815,6 +821,8 @@ tf_rm_is_allocated(struct tf_rm_is_allocated_parms *parms)
        TF_CHECK_PARMS2(parms, parms->rm_db);
 
        rm_db = (struct tf_rm_new_db *)parms->rm_db;
+       if (!rm_db->db)
+               return -EINVAL;
        cfg_type = rm_db->db[parms->db_index].cfg_type;
 
        /* Bail out if not controlled by RM */
@@ -841,6 +849,8 @@ tf_rm_is_allocated(struct tf_rm_is_allocated_parms *parms)
        if (rc)
                return rc;
 
+       if (parms->base_index)
+               *parms->base_index = adj_index;
        *parms->allocated = ba_inuse(rm_db->db[parms->db_index].pool,
                                     adj_index);
 
@@ -856,6 +866,8 @@ tf_rm_get_info(struct tf_rm_get_alloc_info_parms *parms)
        TF_CHECK_PARMS2(parms, parms->rm_db);
 
        rm_db = (struct tf_rm_new_db *)parms->rm_db;
+       if (!rm_db->db)
+               return -EINVAL;
        cfg_type = rm_db->db[parms->db_index].cfg_type;
 
        /* Bail out if not controlled by HCAPI */
@@ -879,6 +891,8 @@ tf_rm_get_hcapi_type(struct tf_rm_get_hcapi_parms *parms)
        TF_CHECK_PARMS2(parms, parms->rm_db);
 
        rm_db = (struct tf_rm_new_db *)parms->rm_db;
+       if (!rm_db->db)
+               return -EINVAL;
        cfg_type = rm_db->db[parms->db_index].cfg_type;
 
        /* Bail out if not controlled by HCAPI */
@@ -901,6 +915,8 @@ tf_rm_get_inuse_count(struct tf_rm_get_inuse_count_parms *parms)
        TF_CHECK_PARMS2(parms, parms->rm_db);
 
        rm_db = (struct tf_rm_new_db *)parms->rm_db;
+       if (!rm_db->db)
+               return -EINVAL;
        cfg_type = rm_db->db[parms->db_index].cfg_type;
 
        /* Bail out if not controlled by RM */
@@ -920,3 +936,44 @@ tf_rm_get_inuse_count(struct tf_rm_get_inuse_count_parms *parms)
        return rc;
 
 }
+
+int
+tf_rm_check_indexes_in_range(struct tf_rm_check_indexes_in_range_parms *parms)
+{
+       struct tf_rm_new_db *rm_db;
+       enum tf_rm_elem_cfg_type cfg_type;
+       uint32_t base_index;
+       uint32_t stride;
+       int rc = 0;
+
+       TF_CHECK_PARMS2(parms, parms->rm_db);
+
+       rm_db = (struct tf_rm_new_db *)parms->rm_db;
+       if (!rm_db->db)
+               return -EINVAL;
+       cfg_type = rm_db->db[parms->db_index].cfg_type;
+
+       /* Bail out if not controlled by RM */
+       if (cfg_type != TF_RM_ELEM_CFG_HCAPI_BA)
+               return -ENOTSUP;
+
+       /* Bail out if the pool is not valid, should never happen */
+       if (rm_db->db[parms->db_index].pool == NULL) {
+               rc = -ENOTSUP;
+               TFP_DRV_LOG(ERR,
+                           "%s: Invalid pool for this type:%d, rc:%s\n",
+                           tf_dir_2_str(rm_db->dir),
+                           parms->db_index,
+                           strerror(-rc));
+               return rc;
+       }
+
+       base_index = rm_db->db[parms->db_index].alloc.entry.start;
+       stride = rm_db->db[parms->db_index].alloc.entry.stride;
+
+       if (parms->starting_index < base_index ||
+           parms->starting_index + parms->num_entries > base_index + stride)
+               return -EINVAL;
+
+       return rc;
+}