Commit 919f9f49 authored by Taehee Yoo's avatar Taehee Yoo Committed by Paolo Abeni
Browse files

eth: bnxt: fix out-of-range access of vnic_info array 



The bnxt_queue_{start | stop}() access vnic_info as much as allocated,
which indicates bp->nr_vnics.
So, it should not reach bp->vnic_info[bp->nr_vnics].

Fixes: 66195855 ("eth: bnxt: do not use BNXT_VNIC_NTUPLE unconditionally in queue restart logic")
Signed-off-by: default avatarTaehee Yoo <ap420073@gmail.com>
Reviewed-by: default avatarMichael Chan <michael.chan@broadcom.com>
Link: https://patch.msgid.link/20250316025837.939527-1-ap420073@gmail.com


Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parent f653b608

drivers/net/ethernet/broadcom/bnxt/bnxt.c

+2 −2
Original line number Diff line number Diff line
@@ -15651,7 +15651,7 @@ static int bnxt_queue_start(struct net_device *dev, void *qmem, int idx) 
	cpr = &rxr->bnapi->cp_ring;

	cpr->sw_stats->rx.rx_resets++;



	for (i = 0; i <= bp->nr_vnics; i++) {

	for (i = 0; i < bp->nr_vnics; i++) {

		vnic = &bp->vnic_info[i];



		rc = bnxt_hwrm_vnic_set_rss_p5(bp, vnic, true);
@@ -15679,7 +15679,7 @@ static int bnxt_queue_stop(struct net_device *dev, void *qmem, int idx) 
	struct bnxt_vnic_info *vnic;

	int i;



	for (i = 0; i <= bp->nr_vnics; i++) {

	for (i = 0; i < bp->nr_vnics; i++) {

		vnic = &bp->vnic_info[i];

		vnic->mru = 0;

		bnxt_hwrm_vnic_update(bp, vnic,