summaryrefslogtreecommitdiffstats
path: root/drivers/net/ethernet/broadcom
diff options
context:
space:
mode:
authorVenkat Duvvuru <venkatkumar.duvvuru@broadcom.com>2019-11-13 13:51:19 -0500
committerDavid S. Miller <davem@davemloft.net>2019-11-13 14:28:30 -0800
commit3128aad163d36d99247fc76b4efbbba2d5465cc4 (patch)
treeb3810c43b5f2450619555e48fd9cd64d9d296479 /drivers/net/ethernet/broadcom
parent75a1ccfe6c726ba33a2f9859d39deb2eba620583 (diff)
downloadlinux-3128aad163d36d99247fc76b4efbbba2d5465cc4.tar.bz2
bnxt_en: Fix array overrun in bnxt_fill_l2_rewrite_fields().
Fix the array overrun while keeping the eth_addr and eth_addr_mask pointers as u16 to avoid unaligned u16 access. These were overlooked when modifying the code to use u16 pointer for proper alignment. Fixes: 90f906243bf6 ("bnxt_en: Add support for L2 rewrite") Reported-by: Olof Johansson <olof@lixom.net> Signed-off-by: Venkat Duvvuru <venkatkumar.duvvuru@broadcom.com> Signed-off-by: Michael Chan <michael.chan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet/broadcom')
-rw-r--r--drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c4
-rw-r--r--drivers/net/ethernet/broadcom/bnxt/bnxt_tc.h4
2 files changed, 4 insertions, 4 deletions
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
index 174412a55e53..0cc6ec51f45f 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
@@ -166,8 +166,8 @@ bnxt_fill_l2_rewrite_fields(struct bnxt_tc_actions *actions,
actions->l2_rewrite_dmac[j] = cpu_to_be16(*(p + j));
}
- if (!is_wildcard(&eth_addr_mask[ETH_ALEN], ETH_ALEN)) {
- if (!is_exactmatch(&eth_addr_mask[ETH_ALEN], ETH_ALEN))
+ if (!is_wildcard(&eth_addr_mask[ETH_ALEN / 2], ETH_ALEN)) {
+ if (!is_exactmatch(&eth_addr_mask[ETH_ALEN / 2], ETH_ALEN))
return -EINVAL;
/* FW expects smac to be in u16 array format */
p = &eth_addr[ETH_ALEN / 2];
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.h
index 286754903543..10c62b094914 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.h
@@ -64,9 +64,9 @@ struct bnxt_tc_tunnel_key {
#define bnxt_eth_addr_key_mask_invalid(eth_addr, eth_addr_mask) \
((is_wildcard(&(eth_addr)[0], ETH_ALEN) && \
- is_wildcard(&(eth_addr)[ETH_ALEN], ETH_ALEN)) || \
+ is_wildcard(&(eth_addr)[ETH_ALEN / 2], ETH_ALEN)) || \
(is_wildcard(&(eth_addr_mask)[0], ETH_ALEN) && \
- is_wildcard(&(eth_addr_mask)[ETH_ALEN], ETH_ALEN)))
+ is_wildcard(&(eth_addr_mask)[ETH_ALEN / 2], ETH_ALEN)))
struct bnxt_tc_actions {
u32 flags;