be2net: pass wrb_params in case of OS2BMC

commit 7d277a7a58578dd62fd546ddaef459ec24ccae36 upstream.

be_insert_vlan_in_pkt() is called with the wrb_params argument being NULL
at be_send_pkt_to_bmc() call site.  This may lead to dereferencing a NULL
pointer when processing a workaround for specific packet, as commit
bc0c3405abbb ("be2net: fix a Tx stall bug caused by a specific ipv6
packet") states.

The correct way would be to pass the wrb_params from be_xmit().

Fixes: 760c295e0e8d ("be2net: Support for OS2BMC.")
Cc: stable@vger.kernel.org
Signed-off-by: Andrey Vatoropin <a.vatoropin@crpt.ru>
Link: https://patch.msgid.link/20251119105015.194501-1-a.vatoropin@crpt.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index ce235def334f79e01115ea74c65532d3074e7b2b..a142dfea8da9ca117daf08426e3bb6bcd03673c8 100644 (file)
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -1298,7 +1298,8 @@ static void be_xmit_flush(struct be_adapter *adapter, struct be_tx_obj *txo)
                (adapter->bmc_filt_mask & BMC_FILT_MULTICAST)
 
 static bool be_send_pkt_to_bmc(struct be_adapter *adapter,
-                              struct sk_buff **skb)
+                              struct sk_buff **skb,
+                              struct be_wrb_params *wrb_params)
 {
        struct ethhdr *eh = (struct ethhdr *)(*skb)->data;
        bool os2bmc = false;
@@ -1362,7 +1363,7 @@ done:
         * to BMC, asic expects the vlan to be inline in the packet.
         */
        if (os2bmc)
-               *skb = be_insert_vlan_in_pkt(adapter, *skb, NULL);
+               *skb = be_insert_vlan_in_pkt(adapter, *skb, wrb_params);
 
        return os2bmc;
 }
@@ -1389,7 +1390,7 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev)
        /* if os2bmc is enabled and if the pkt is destined to bmc,
         * enqueue the pkt a 2nd time with mgmt bit set.
         */
-       if (be_send_pkt_to_bmc(adapter, &skb)) {
+       if (be_send_pkt_to_bmc(adapter, &skb, &wrb_params)) {
                BE_WRB_F_SET(wrb_params.features, OS2BMC, 1);
                wrb_cnt = be_xmit_enqueue(adapter, txo, skb, &wrb_params);
                if (unlikely(!wrb_cnt))