ixgbe: fix incorrect map used in eee linkmode

aloktiwa · gregkh · commit 129c1cb8a081 · 2025-09-09T19:02:24.000+02:00
[ Upstream commit b7e5c3e ] incorrectly used ixgbe_lp_map in loops intended to populate the supported and advertised EEE linkmode bitmaps based on ixgbe_ls_map. This results in incorrect bit setting and potential out-of-bounds access, since ixgbe_lp_map and ixgbe_ls_map have different sizes and purposes. ixgbe_lp_map[i] -> ixgbe_ls_map[i] Use ixgbe_ls_map for supported and advertised linkmodes, and keep ixgbe_lp_map usage only for link partner (lp_advertised) mapping. Fixes: 9356b6d ("net: ethernet: ixgbe: Convert EEE to use linkmodes") Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de> Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
@@ -3565,13 +3565,13 @@ ixgbe_get_eee_fw(struct ixgbe_adapter *adapter, struct ethtool_keee *edata)
 
 	for (i = 0; i < ARRAY_SIZE(ixgbe_ls_map); ++i) {
 		if (hw->phy.eee_speeds_supported & ixgbe_ls_map[i].mac_speed)
-			linkmode_set_bit(ixgbe_lp_map[i].link_mode,
+			linkmode_set_bit(ixgbe_ls_map[i].link_mode,
 					 edata->supported);
 	}
 
 	for (i = 0; i < ARRAY_SIZE(ixgbe_ls_map); ++i) {
 		if (hw->phy.eee_speeds_advertised & ixgbe_ls_map[i].mac_speed)
-			linkmode_set_bit(ixgbe_lp_map[i].link_mode,
+			linkmode_set_bit(ixgbe_ls_map[i].link_mode,
 					 edata->advertised);
 	}
 

Original file line number	Diff line number	Diff line change
`@@ -3565,13 +3565,13 @@ ixgbe_get_eee_fw(struct ixgbe_adapter adapter, struct ethtool_keee edata)`
`3565`	`3565`
`3566`	`3566`	`for (i = 0; i < ARRAY_SIZE(ixgbe_ls_map); ++i) {`
`3567`	`3567`	`if (hw->phy.eee_speeds_supported & ixgbe_ls_map[i].mac_speed)`
`3568`		`- linkmode_set_bit(ixgbe_lp_map[i].link_mode,`
	`3568`	`+ linkmode_set_bit(ixgbe_ls_map[i].link_mode,`
`3569`	`3569`	`edata->supported);`
`3570`	`3570`	`}`
`3571`	`3571`
`3572`	`3572`	`for (i = 0; i < ARRAY_SIZE(ixgbe_ls_map); ++i) {`
`3573`	`3573`	`if (hw->phy.eee_speeds_advertised & ixgbe_ls_map[i].mac_speed)`
`3574`		`- linkmode_set_bit(ixgbe_lp_map[i].link_mode,`
	`3574`	`+ linkmode_set_bit(ixgbe_ls_map[i].link_mode,`
`3575`	`3575`	`edata->advertised);`
`3576`	`3576`	`}`
`3577`	`3577`