Commit 9b68a1cc authored by Ding Hui's avatar Ding Hui Committed by Leon Romanovsky
Browse files

RDMA/bnxt_re: Fix OOB write in bnxt_re_copy_err_stats() 



Commit ef56081d ("RDMA/bnxt_re: RoCE related hardware counters
update") added three new counters and placed them after
BNXT_RE_OUT_OF_SEQ_ERR.

BNXT_RE_OUT_OF_SEQ_ERR acts as a boundary marker for allocating hardware
statistics with different num_counters values on chip_gen_p5_p7 devices.

As a result, BNXT_RE_NUM_STD_COUNTERS are used when allocating
hw_stats, which leads to an out-of-bounds write in
bnxt_re_copy_err_stats().

The counters BNXT_RE_REQ_CQE_ERROR, BNXT_RE_RESP_CQE_ERROR, and
BNXT_RE_RESP_REMOTE_ACCESS_ERRS are applicable to generic hardware, not
only p5/p7 devices.

Fix this by moving these counters before BNXT_RE_OUT_OF_SEQ_ERR so they
are included in the generic counter set.

Fixes: ef56081d ("RDMA/bnxt_re: RoCE related hardware counters update")
Reported-by: default avatarYingying Zheng <zhengyingying@sangfor.com.cn>
Signed-off-by: default avatarDing Hui <dinghui@sangfor.com.cn>
Link: https://patch.msgid.link/20251208072110.28874-1-dinghui@sangfor.com.cn


Reviewed-by: default avatarKalesh AP <kalesh-anakkur.purayil@broadcom.com>
Tested-by: default avatarKalesh AP <kalesh-anakkur.purayil@broadcom.com>
Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
parent f01765a2

drivers/infiniband/hw/bnxt_re/hw_counters.h

+3 −3
Original line number Diff line number Diff line
@@ -89,6 +89,9 @@ enum bnxt_re_hw_stats { 
	BNXT_RE_RES_SRQ_LOAD_ERR,

	BNXT_RE_RES_TX_PCI_ERR,

	BNXT_RE_RES_RX_PCI_ERR,

	BNXT_RE_REQ_CQE_ERROR,

	BNXT_RE_RESP_CQE_ERROR,

	BNXT_RE_RESP_REMOTE_ACCESS_ERRS,

	BNXT_RE_OUT_OF_SEQ_ERR,

	BNXT_RE_TX_ATOMIC_REQ,

	BNXT_RE_TX_READ_REQ,
@@ -110,9 +113,6 @@ enum bnxt_re_hw_stats { 
	BNXT_RE_TX_CNP,

	BNXT_RE_RX_CNP,

	BNXT_RE_RX_ECN,

	BNXT_RE_REQ_CQE_ERROR,

	BNXT_RE_RESP_CQE_ERROR,

	BNXT_RE_RESP_REMOTE_ACCESS_ERRS,

	BNXT_RE_NUM_EXT_COUNTERS

};