bnxt_en: Fix array overrun in bnxt_fill_l2_rewrite_fields().

Fix the array overrun while keeping the eth_addr and eth_addr_mask
pointers as u16 to avoid unaligned u16 access.  These were overlooked
when modifying the code to use u16 pointer for proper alignment.

Fixes: 90f906243bf6 ("bnxt_en: Add support for L2 rewrite")
Reported-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Venkat Duvvuru <venkatkumar.duvvuru@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
index 174412a55e53c95e9344e972137f46fb503c66d4..0cc6ec51f45fe2ab028bb3c0299dbef0fd3bf088 100644 (file)
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
@@ -166,8 +166,8 @@ bnxt_fill_l2_rewrite_fields(struct bnxt_tc_actions *actions,
                        actions->l2_rewrite_dmac[j] = cpu_to_be16(*(p + j));
        }
 
-       if (!is_wildcard(&eth_addr_mask[ETH_ALEN], ETH_ALEN)) {
-               if (!is_exactmatch(&eth_addr_mask[ETH_ALEN], ETH_ALEN))
+       if (!is_wildcard(&eth_addr_mask[ETH_ALEN / 2], ETH_ALEN)) {
+               if (!is_exactmatch(&eth_addr_mask[ETH_ALEN / 2], ETH_ALEN))
                        return -EINVAL;
                /* FW expects smac to be in u16 array format */
                p = &eth_addr[ETH_ALEN / 2];

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.h
index 2867549035431ccff5ab974f68b6d463625f4383..10c62b09491484b313a79af9202f4301fd2f0cec 100644 (file)
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.h
@@ -64,9 +64,9 @@ struct bnxt_tc_tunnel_key {
 
 #define bnxt_eth_addr_key_mask_invalid(eth_addr, eth_addr_mask)                \
        ((is_wildcard(&(eth_addr)[0], ETH_ALEN) &&                      \
-        is_wildcard(&(eth_addr)[ETH_ALEN], ETH_ALEN)) ||               \
+        is_wildcard(&(eth_addr)[ETH_ALEN / 2], ETH_ALEN)) ||           \
        (is_wildcard(&(eth_addr_mask)[0], ETH_ALEN) &&                  \
-        is_wildcard(&(eth_addr_mask)[ETH_ALEN], ETH_ALEN)))
+        is_wildcard(&(eth_addr_mask)[ETH_ALEN / 2], ETH_ALEN)))
 
 struct bnxt_tc_actions {
        u32                             flags;