[PATCH net 2/3] net/mlx5: HWS, Fix heap buffer overflow in insert header action

[Tariq Toukan]

From: Yevgeny Kliteynik <kliteyn@xxxxxxxxxx>

hws_action_create_generic() allocates only a single action struct,
but the loop writes to action[i] for each of the num_of_hdrs entries.
When num_of_hdrs > 1 this overflows the allocated buffer.

Use hws_action_create_generic_bulk() to allocate the right number
of actions.

Fixes: 504e536d9010 ("net/mlx5: HWS, added actions handling")
Signed-off-by: Yevgeny Kliteynik <kliteyn@xxxxxxxxxx>
Reviewed-by: Itamar Gozlan <igozlan@xxxxxxxxxx>
Signed-off-by: Tariq Toukan <tariqt@xxxxxxxxxx>
---
 .../net/ethernet/mellanox/mlx5/core/steering/hws/action.c  | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c
index 23e86f292022..9caaa34074db 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c
@@ -1473,7 +1473,12 @@ mlx5hws_action_create_insert_header(struct mlx5hws_context *ctx,
 	int ret;
 	int i;
 
-	action = hws_action_create_generic(ctx, flags, MLX5HWS_ACTION_TYP_INSERT_HEADER);
+	if (!num_of_hdrs)
+		return NULL;
+
+	action = hws_action_create_generic_bulk(ctx, flags,
+						MLX5HWS_ACTION_TYP_INSERT_HEADER,
+						num_of_hdrs);
 	if (!action)
 		return NULL;
 
-- 
2.44.0