bnxt_en: Fix array overrun in bnxt_fill_l2_rewrite_fields(). (3128aad1) · Commits · 戴 / test

Fix the array overrun while keeping the eth_addr and eth_addr_mask pointers as u16 to avoid unaligned u16 access. These were overlooked when modifying the code to use u16 pointer for proper alignment. Fixes: ("bnxt_en: Add support for L2 rewrite") Reported-by:

Olof Johansson <olof@lixom.net> Signed-off-by:

Venkat Duvvuru <venkatkumar.duvvuru@broadcom.com> Signed-off-by:

Michael Chan <michael.chan@broadcom.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -166,8 +166,8 @@ bnxt_fill_l2_rewrite_fields(struct bnxt_tc_actions *actions,
		actions->l2_rewrite_dmac[j] = cpu_to_be16(*(p + j));
		}

		if (!is_wildcard(&eth_addr_mask[ETH_ALEN], ETH_ALEN)) {
		if (!is_exactmatch(&eth_addr_mask[ETH_ALEN], ETH_ALEN))
		if (!is_wildcard(&eth_addr_mask[ETH_ALEN / 2], ETH_ALEN)) {
		if (!is_exactmatch(&eth_addr_mask[ETH_ALEN / 2], ETH_ALEN))
		return -EINVAL;
		/* FW expects smac to be in u16 array format */
		p = &eth_addr[ETH_ALEN / 2];

drivers/net/ethernet/broadcom/bnxt/bnxt_tc.h

+2 −2

Original line number	Diff line number	Diff line
		@@ -64,9 +64,9 @@ struct bnxt_tc_tunnel_key {

		#define bnxt_eth_addr_key_mask_invalid(eth_addr, eth_addr_mask) \
		((is_wildcard(&(eth_addr)[0], ETH_ALEN) && \
		is_wildcard(&(eth_addr)[ETH_ALEN], ETH_ALEN)) \|\| \
		is_wildcard(&(eth_addr)[ETH_ALEN / 2], ETH_ALEN)) \|\| \
		(is_wildcard(&(eth_addr_mask)[0], ETH_ALEN) && \
		is_wildcard(&(eth_addr_mask)[ETH_ALEN], ETH_ALEN)))
		is_wildcard(&(eth_addr_mask)[ETH_ALEN / 2], ETH_ALEN)))

		struct bnxt_tc_actions {
		u32 flags;

Admin message