Re: [PATCH] net: bnxt_en: Fix array overrun in bnxt_fill_l2_rewrite_fields()

[Simon Horman]

On Sun, Nov 10, 2019 at 06:08:55PM -0800, Olof Johansson wrote:
> This is caused by what seems to be a fragile typing approach by
> the Broadcom firmware/driver:
> 
> /* FW expects smac to be in u16 array format */
> 
> So the driver uses eth_addr and eth_addr_mask as u16[6] instead of u8[12],
> so the math in bnxt_fill_l2_rewrite_fields does a [6] deref of the u16
> pointer, it goes out of bounds on the array.
> 
> Just a few lines below, they use ETH_ALEN/2, so this must have been
> overlooked. I'm surprised original developers didn't notice the compiler
> warnings?!
> 
> Fixes: 90f906243bf6 ("bnxt_en: Add support for L2 rewrite")
> Signed-off-by: Olof Johansson <olof@xxxxxxxxx>

Reviewed-by: Simon Horman <simon.horman@xxxxxxxxxxxxx>