]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
RDMA/bnxt_re: Fix OOB write in bnxt_re_copy_err_stats()
authorDing Hui <dinghui@sangfor.com.cn>
Mon, 8 Dec 2025 07:21:10 +0000 (15:21 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 8 Jan 2026 09:16:50 +0000 (10:16 +0100)
commit369a161c48723f60f06f3510b82ea7d96d0499ab
treec4dd08c02400abddcc8e4cc1fcbe210c675ddee3
parentac4567773ce505763b0d2fb9c0b876db419676c6
RDMA/bnxt_re: Fix OOB write in bnxt_re_copy_err_stats()

[ Upstream commit 9b68a1cc966bc947d00e4c0df7722d118125aa37 ]

Commit ef56081d1864 ("RDMA/bnxt_re: RoCE related hardware counters
update") added three new counters and placed them after
BNXT_RE_OUT_OF_SEQ_ERR.

BNXT_RE_OUT_OF_SEQ_ERR acts as a boundary marker for allocating hardware
statistics with different num_counters values on chip_gen_p5_p7 devices.

As a result, BNXT_RE_NUM_STD_COUNTERS are used when allocating
hw_stats, which leads to an out-of-bounds write in
bnxt_re_copy_err_stats().

The counters BNXT_RE_REQ_CQE_ERROR, BNXT_RE_RESP_CQE_ERROR, and
BNXT_RE_RESP_REMOTE_ACCESS_ERRS are applicable to generic hardware, not
only p5/p7 devices.

Fix this by moving these counters before BNXT_RE_OUT_OF_SEQ_ERR so they
are included in the generic counter set.

Fixes: ef56081d1864 ("RDMA/bnxt_re: RoCE related hardware counters update")
Reported-by: Yingying Zheng <zhengyingying@sangfor.com.cn>
Signed-off-by: Ding Hui <dinghui@sangfor.com.cn>
Link: https://patch.msgid.link/20251208072110.28874-1-dinghui@sangfor.com.cn
Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Tested-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/infiniband/hw/bnxt_re/hw_counters.h