cxgb3 - tighten checks on TID values

Enforce validity checks on connection ids

Signed-off-by: Divy Le Ray <divy@chelsio.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

1 files changed, 18 insertions, 2 deletions

diff --git a/drivers/net/cxgb3/cxgb3_defs.h b/drivers/net/cxgb3/cxgb3_defs.h
index 483a594210a7..45e92164c260 100644
--- a/drivers/net/cxgb3/cxgb3_defs.h
+++ b/drivers/net/cxgb3/cxgb3_defs.h
@@ -79,9 +79,17 @@ static inline struct t3c_tid_entry *lookup_tid(const struct tid_info *t,
 static inline struct t3c_tid_entry *lookup_stid(const struct tid_info *t,
                                                 unsigned int tid)
 {
+        union listen_entry *e;
+
         if (tid < t->stid_base || tid >= t->stid_base + t->nstids)
                 return NULL;
-        return &(stid2entry(t, tid)->t3c_tid);
+
+        e = stid2entry(t, tid);
+        if ((void *)e->next >= (void *)t->tid_tab &&
+            (void *)e->next < (void *)&t->atid_tab[t->natids])
+                return NULL;
+
+        return &e->t3c_tid;
 }
 
 /*
@@ -90,9 +98,17 @@ static inline struct t3c_tid_entry *lookup_stid(const struct tid_info *t,
 static inline struct t3c_tid_entry *lookup_atid(const struct tid_info *t,
                                                 unsigned int tid)
 {
+        union active_open_entry *e;
+
         if (tid < t->atid_base || tid >= t->atid_base + t->natids)
                 return NULL;
-        return &(atid2entry(t, tid)->t3c_tid);
+
+        e = atid2entry(t, tid);
+        if ((void *)e->next >= (void *)t->tid_tab &&
+            (void *)e->next < (void *)&t->atid_tab[t->natids])
+                return NULL;
+
+        return &e->t3c_tid;
 }
 
 int process_rx(struct t3cdev *dev, struct sk_buff **skbs, int n);