diff options
| author | Jakub Kicinski <kuba@kernel.org> | 2024-07-05 05:00:05 +0300 |
|---|---|---|
| committer | Paolo Abeni <pabeni@redhat.com> | 2024-07-09 12:35:49 +0300 |
| commit | 0d1b7d6c927431126ece585246e23aa877243360 (patch) | |
| tree | ea418e0d0805be009ee11afd8b3aaa1b9c9d0bd6 /scripts/gdb/linux/interrupts.py | |
| parent | 30f747b8d53bc73555f268d0f48f56174fa5bf10 (diff) | |
| download | linux-0d1b7d6c927431126ece585246e23aa877243360.tar.xz | |
bnxt: fix crashes when reducing ring count with active RSS contexts
bnxt doesn't check if a ring is used by RSS contexts when reducing
ring count. Core performs a similar check for the drivers for
the main context, but core doesn't know about additional contexts,
so it can't validate them. bnxt_fill_hw_rss_tbl_p5() uses ring
id to index bp->rx_ring[], which without the check may end up
being out of bounds.
BUG: KASAN: slab-out-of-bounds in __bnxt_hwrm_vnic_set_rss+0xb79/0xe40
Read of size 2 at addr ffff8881c5809618 by task ethtool/31525
Call Trace:
__bnxt_hwrm_vnic_set_rss+0xb79/0xe40
bnxt_hwrm_vnic_rss_cfg_p5+0xf7/0x460
__bnxt_setup_vnic_p5+0x12e/0x270
__bnxt_open_nic+0x2262/0x2f30
bnxt_open_nic+0x5d/0xf0
ethnl_set_channels+0x5d4/0xb30
ethnl_default_set_doit+0x2f1/0x620
Core does track the additional contexts in net-next, so we can
move this validation out of the driver as a follow up there.
Fixes: b3d0083caf9a ("bnxt_en: Support RSS contexts in ethtool .{get|set}_rxfh()")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Link: https://patch.msgid.link/20240705020005.681746-1-kuba@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Diffstat (limited to 'scripts/gdb/linux/interrupts.py')
0 files changed, 0 insertions, 0 deletions