ixgbe: fix incorrect map used in eee linkmode

aloktiwa · gregkh · commit 682105ab6382 · 2025-09-09T18:58:09.000+02:00
[ Upstream commit b7e5c3e ] incorrectly used ixgbe_lp_map in loops intended to populate the supported and advertised EEE linkmode bitmaps based on ixgbe_ls_map. This results in incorrect bit setting and potential out-of-bounds access, since ixgbe_lp_map and ixgbe_ls_map have different sizes and purposes. ixgbe_lp_map[i] -> ixgbe_ls_map[i] Use ixgbe_ls_map for supported and advertised linkmodes, and keep ixgbe_lp_map usage only for link partner (lp_advertised) mapping. Fixes: 9356b6d ("net: ethernet: ixgbe: Convert EEE to use linkmodes") Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de> Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
@@ -3443,13 +3443,13 @@ ixgbe_get_eee_fw(struct ixgbe_adapter *adapter, struct ethtool_keee *edata)
 
 	for (i = 0; i < ARRAY_SIZE(ixgbe_ls_map); ++i) {
 		if (hw->phy.eee_speeds_supported & ixgbe_ls_map[i].mac_speed)
-			linkmode_set_bit(ixgbe_lp_map[i].link_mode,
+			linkmode_set_bit(ixgbe_ls_map[i].link_mode,
 					 edata->supported);
 	}
 
 	for (i = 0; i < ARRAY_SIZE(ixgbe_ls_map); ++i) {
 		if (hw->phy.eee_speeds_advertised & ixgbe_ls_map[i].mac_speed)
-			linkmode_set_bit(ixgbe_lp_map[i].link_mode,
+			linkmode_set_bit(ixgbe_ls_map[i].link_mode,
 					 edata->advertised);
 	}
 

Original file line number	Diff line number	Diff line change
`@@ -3443,13 +3443,13 @@ ixgbe_get_eee_fw(struct ixgbe_adapter adapter, struct ethtool_keee edata)`
`3443`	`3443`
`3444`	`3444`	`for (i = 0; i < ARRAY_SIZE(ixgbe_ls_map); ++i) {`
`3445`	`3445`	`if (hw->phy.eee_speeds_supported & ixgbe_ls_map[i].mac_speed)`
`3446`		`- linkmode_set_bit(ixgbe_lp_map[i].link_mode,`
	`3446`	`+ linkmode_set_bit(ixgbe_ls_map[i].link_mode,`
`3447`	`3447`	`edata->supported);`
`3448`	`3448`	`}`
`3449`	`3449`
`3450`	`3450`	`for (i = 0; i < ARRAY_SIZE(ixgbe_ls_map); ++i) {`
`3451`	`3451`	`if (hw->phy.eee_speeds_advertised & ixgbe_ls_map[i].mac_speed)`
`3452`		`- linkmode_set_bit(ixgbe_lp_map[i].link_mode,`
	`3452`	`+ linkmode_set_bit(ixgbe_ls_map[i].link_mode,`
`3453`	`3453`	`edata->advertised);`
`3454`	`3454`	`}`
`3455`	`3455`