* [PATCH net-next] bnxt_en: Fix array overrun in bnxt_fill_l2_rewrite_fields().
@ 2019-11-13 18:51 Michael Chan
2019-11-13 22:33 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Michael Chan @ 2019-11-13 18:51 UTC (permalink / raw)
To: davem; +Cc: netdev, olof, Venkat Duvvuru
From: Venkat Duvvuru <venkatkumar.duvvuru@broadcom.com>
Fix the array overrun while keeping the eth_addr and eth_addr_mask
pointers as u16 to avoid unaligned u16 access. These were overlooked
when modifying the code to use u16 pointer for proper alignment.
Fixes: 90f906243bf6 ("bnxt_en: Add support for L2 rewrite")
Reported-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Venkat Duvvuru <venkatkumar.duvvuru@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
---
drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 4 ++--
drivers/net/ethernet/broadcom/bnxt/bnxt_tc.h | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
index 174412a..0cc6ec5 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
@@ -166,8 +166,8 @@ bnxt_fill_l2_rewrite_fields(struct bnxt_tc_actions *actions,
actions->l2_rewrite_dmac[j] = cpu_to_be16(*(p + j));
}
- if (!is_wildcard(ð_addr_mask[ETH_ALEN], ETH_ALEN)) {
- if (!is_exactmatch(ð_addr_mask[ETH_ALEN], ETH_ALEN))
+ if (!is_wildcard(ð_addr_mask[ETH_ALEN / 2], ETH_ALEN)) {
+ if (!is_exactmatch(ð_addr_mask[ETH_ALEN / 2], ETH_ALEN))
return -EINVAL;
/* FW expects smac to be in u16 array format */
p = ð_addr[ETH_ALEN / 2];
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.h
index 2867549..10c62b0 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.h
@@ -64,9 +64,9 @@ struct bnxt_tc_tunnel_key {
#define bnxt_eth_addr_key_mask_invalid(eth_addr, eth_addr_mask) \
((is_wildcard(&(eth_addr)[0], ETH_ALEN) && \
- is_wildcard(&(eth_addr)[ETH_ALEN], ETH_ALEN)) || \
+ is_wildcard(&(eth_addr)[ETH_ALEN / 2], ETH_ALEN)) || \
(is_wildcard(&(eth_addr_mask)[0], ETH_ALEN) && \
- is_wildcard(&(eth_addr_mask)[ETH_ALEN], ETH_ALEN)))
+ is_wildcard(&(eth_addr_mask)[ETH_ALEN / 2], ETH_ALEN)))
struct bnxt_tc_actions {
u32 flags;
--
2.5.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net-next] bnxt_en: Fix array overrun in bnxt_fill_l2_rewrite_fields().
2019-11-13 18:51 [PATCH net-next] bnxt_en: Fix array overrun in bnxt_fill_l2_rewrite_fields() Michael Chan
@ 2019-11-13 22:33 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2019-11-13 22:33 UTC (permalink / raw)
To: michael.chan; +Cc: netdev, olof, venkatkumar.duvvuru
From: Michael Chan <michael.chan@broadcom.com>
Date: Wed, 13 Nov 2019 13:51:19 -0500
> From: Venkat Duvvuru <venkatkumar.duvvuru@broadcom.com>
>
> Fix the array overrun while keeping the eth_addr and eth_addr_mask
> pointers as u16 to avoid unaligned u16 access. These were overlooked
> when modifying the code to use u16 pointer for proper alignment.
>
> Fixes: 90f906243bf6 ("bnxt_en: Add support for L2 rewrite")
> Reported-by: Olof Johansson <olof@lixom.net>
> Signed-off-by: Venkat Duvvuru <venkatkumar.duvvuru@broadcom.com>
> Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Applied.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-11-13 22:33 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-11-13 18:51 [PATCH net-next] bnxt_en: Fix array overrun in bnxt_fill_l2_rewrite_fields() Michael Chan
2019-11-13 22:33 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).