RDMA/bnxt_re: Fix OOB write in bnxt_re_copy_err_stats()

Commit ef56081d1864 ("RDMA/bnxt_re: RoCE related hardware counters
update") added three new counters and placed them after
BNXT_RE_OUT_OF_SEQ_ERR.

BNXT_RE_OUT_OF_SEQ_ERR acts as a boundary marker for allocating hardware
statistics with different num_counters values on chip_gen_p5_p7 devices.

As a result, BNXT_RE_NUM_STD_COUNTERS are used when allocating
hw_stats, which leads to an out-of-bounds write in
bnxt_re_copy_err_stats().

The counters BNXT_RE_REQ_CQE_ERROR, BNXT_RE_RESP_CQE_ERROR, and
BNXT_RE_RESP_REMOTE_ACCESS_ERRS are applicable to generic hardware, not
only p5/p7 devices.

Fix this by moving these counters before BNXT_RE_OUT_OF_SEQ_ERR so they
are included in the generic counter set.

Fixes: ef56081d1864 ("RDMA/bnxt_re: RoCE related hardware counters update")
Reported-by: Yingying Zheng <zhengyingying@sangfor.com.cn>
Signed-off-by: Ding Hui <dinghui@sangfor.com.cn>
Link: https://patch.msgid.link/20251208072110.28874-1-dinghui@sangfor.com.cn
Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Tested-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>

diff --git a/drivers/infiniband/hw/bnxt_re/hw_counters.h b/drivers/infiniband/hw/bnxt_re/hw_counters.h
index 09d371d442aa78724f49924ea7f5f8e70253d963..cebec033f4a014e2e5988f5f887eb2cdccb2738c 100644 (file)
--- a/drivers/infiniband/hw/bnxt_re/hw_counters.h
+++ b/drivers/infiniband/hw/bnxt_re/hw_counters.h
@@ -89,6 +89,9 @@ enum bnxt_re_hw_stats {
        BNXT_RE_RES_SRQ_LOAD_ERR,
        BNXT_RE_RES_TX_PCI_ERR,
        BNXT_RE_RES_RX_PCI_ERR,
+       BNXT_RE_REQ_CQE_ERROR,
+       BNXT_RE_RESP_CQE_ERROR,
+       BNXT_RE_RESP_REMOTE_ACCESS_ERRS,
        BNXT_RE_OUT_OF_SEQ_ERR,
        BNXT_RE_TX_ATOMIC_REQ,
        BNXT_RE_TX_READ_REQ,
@@ -110,9 +113,6 @@ enum bnxt_re_hw_stats {
        BNXT_RE_TX_CNP,
        BNXT_RE_RX_CNP,
        BNXT_RE_RX_ECN,
-       BNXT_RE_REQ_CQE_ERROR,
-       BNXT_RE_RESP_CQE_ERROR,
-       BNXT_RE_RESP_REMOTE_ACCESS_ERRS,
        BNXT_RE_NUM_EXT_COUNTERS
 };