From: Yevgeny Kliteynik <redacted>
hws_action_create_generic() allocates only a single action struct,
but the loop writes to action[i] for each of the num_of_hdrs entries.
When num_of_hdrs > 1 this overflows the allocated buffer.
Use hws_action_create_generic_bulk() to allocate the right number
of actions.
Fixes: 504e536d9010 ("net/mlx5: HWS, added actions handling")
Signed-off-by: Yevgeny Kliteynik <redacted>
Reviewed-by: Itamar Gozlan <redacted>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
---
.../net/ethernet/mellanox/mlx5/core/steering/hws/action.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c
index 23e86f292022..9caaa34074db 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c
@@ -1473,7 +1473,12 @@ mlx5hws_action_create_insert_header(struct mlx5hws_context *ctx,
int ret;
int i;
- action = hws_action_create_generic(ctx, flags, MLX5HWS_ACTION_TYP_INSERT_HEADER);
+ if (!num_of_hdrs)
+ return NULL;
+
+ action = hws_action_create_generic_bulk(ctx, flags,
+ MLX5HWS_ACTION_TYP_INSERT_HEADER,
+ num_of_hdrs);
if (!action)
return NULL;
--
2.44.0