[PATCH v2] net/bnxt: fix memory corruption in tunnel entry list

[Mohammad Shuab Siddique]

From: Kishore Padmanabha <kishore.padmanabha at broadcom.com>

In ulp_app_tun_search_entry(), when a matching tunnel entry is found
at index i, the reference count was incremented on
tun_ent_list[free_entry] instead of tun_ent_list[i]. free_entry is -1
when no unused slot precedes the match (always the case when the table
is full), so this wrote before the start of the array; otherwise it
bumped the count of an unused slot and left the matched entry's count
unchanged. Use the matching index.

Fixes: bdf4a3c6316b ("net/bnxt: support tunnel offload")
Cc: stable at dpdk.org

Signed-off-by: Kishore Padmanabha <kishore.padmanabha at broadcom.com>
Signed-off-by: Manish Kurup <manish.kurup at broadcom.com>
Signed-off-by: Mohammad Shuab Siddique <mohammad-shuab.siddique at broadcom.com>
---
v2:
 - Reword the commit message: free_entry is -1 whenever no unused slot precedes the matching entry, not only when the table is full
 - No code change

 drivers/net/bnxt/tf_ulp/ulp_tun.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/bnxt/tf_ulp/ulp_tun.c b/drivers/net/bnxt/tf_ulp/ulp_tun.c
index b90b4bf2523..8ecdac0dcce 100644
--- a/drivers/net/bnxt/tf_ulp/ulp_tun.c
+++ b/drivers/net/bnxt/tf_ulp/ulp_tun.c
@@ -33,7 +33,7 @@ ulp_app_tun_search_entry(struct bnxt_ulp_context *ulp_ctx,
 				    app_tunnel,
 				    sizeof(struct rte_flow_tunnel))) {
 				*tun_entry =  &tun_ent_list[i];
-				tun_ent_list[free_entry].ref_cnt++;
+				tun_ent_list[i].ref_cnt++;
 				return rc;
 			}
 		}
-- 
2.47.3