Re: [PATCH net 01/12] net: systemport: Fix buffer overflow in bcm_sysport_get_stats()

[Nicolai Buchwitz]

On 22.9.2026 01:12, Florian Fainelli wrote:
> When running on SYSTEMPORT Lite, certain statistics are unsupported and
> skipped during bcm_sysport_get_stats(). The variable 'j' tracks the
> compacted index into the destination data buffer, whereas 'i' iterates
> over all elements in bcm_sysport_gstrings_stats.
>
> Because the buffer allocated by ethtool is sized only according to
> bcm_sysport_get_sset_count(), storing values at data[i] instead of
> data[j] writes past the allocated array bounds, leading to memory
> corruption.
>
> Fix this by writing to data[j] instead of data[i].
>
> Fixes: 10377ba7673d ("net: systemport: Support 64bit statistics")
> Assisted-by: LLM
> Signed-off-by: Florian Fainelli <florian.fainelli@xxxxxxxxxxxx>
> ---
>  drivers/net/ethernet/broadcom/bcmsysport.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c 
> b/drivers/net/ethernet/broadcom/bcmsysport.c
> index 4d06c6ba6641..db627cd15fb7 100644
> --- a/drivers/net/ethernet/broadcom/bcmsysport.c
> +++ b/drivers/net/ethernet/broadcom/bcmsysport.c
> @@ -482,10 +482,10 @@ static void bcm_sysport_get_stats(struct 
> net_device *dev,
>  		    s->type == BCM_SYSPORT_STAT_NETDEV64) {
>  			do {
>  				start = u64_stats_fetch_begin(syncp);
> -				data[i] = *(u64 *)p;
> +				data[j] = *(u64 *)p;
>  			} while (u64_stats_fetch_retry(syncp, start));
>  		} else
> -			data[i] = *(u32 *)p;
> +			data[j] = *(u32 *)p;
>  		j++;
>  	}

Reviewed-by: Nicolai Buchwitz <nb@xxxxxxxxxxx>

Thanks,
Nicolai