Skip to content

Commit 9b68a1c

Browse files
cdkeyrleon
authored andcommitted
RDMA/bnxt_re: Fix OOB write in bnxt_re_copy_err_stats()
Commit ef56081 ("RDMA/bnxt_re: RoCE related hardware counters update") added three new counters and placed them after BNXT_RE_OUT_OF_SEQ_ERR. BNXT_RE_OUT_OF_SEQ_ERR acts as a boundary marker for allocating hardware statistics with different num_counters values on chip_gen_p5_p7 devices. As a result, BNXT_RE_NUM_STD_COUNTERS are used when allocating hw_stats, which leads to an out-of-bounds write in bnxt_re_copy_err_stats(). The counters BNXT_RE_REQ_CQE_ERROR, BNXT_RE_RESP_CQE_ERROR, and BNXT_RE_RESP_REMOTE_ACCESS_ERRS are applicable to generic hardware, not only p5/p7 devices. Fix this by moving these counters before BNXT_RE_OUT_OF_SEQ_ERR so they are included in the generic counter set. Fixes: ef56081 ("RDMA/bnxt_re: RoCE related hardware counters update") Reported-by: Yingying Zheng <zhengyingying@sangfor.com.cn> Signed-off-by: Ding Hui <dinghui@sangfor.com.cn> Link: https://patch.msgid.link/20251208072110.28874-1-dinghui@sangfor.com.cn Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com> Tested-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
1 parent f01765a commit 9b68a1c

1 file changed

Lines changed: 3 additions & 3 deletions

File tree

drivers/infiniband/hw/bnxt_re/hw_counters.h

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,9 @@ enum bnxt_re_hw_stats {
8989
BNXT_RE_RES_SRQ_LOAD_ERR,
9090
BNXT_RE_RES_TX_PCI_ERR,
9191
BNXT_RE_RES_RX_PCI_ERR,
92+
BNXT_RE_REQ_CQE_ERROR,
93+
BNXT_RE_RESP_CQE_ERROR,
94+
BNXT_RE_RESP_REMOTE_ACCESS_ERRS,
9295
BNXT_RE_OUT_OF_SEQ_ERR,
9396
BNXT_RE_TX_ATOMIC_REQ,
9497
BNXT_RE_TX_READ_REQ,
@@ -110,9 +113,6 @@ enum bnxt_re_hw_stats {
110113
BNXT_RE_TX_CNP,
111114
BNXT_RE_RX_CNP,
112115
BNXT_RE_RX_ECN,
113-
BNXT_RE_REQ_CQE_ERROR,
114-
BNXT_RE_RESP_CQE_ERROR,
115-
BNXT_RE_RESP_REMOTE_ACCESS_ERRS,
116116
BNXT_RE_NUM_EXT_COUNTERS
117117
};
118118

0 commit comments

Comments
 (0)