eth: bnxt: fix out-of-range access of vnic_info array

JIRA: https://issues.redhat.com/browse/RHEL-107291
CVE: CVE-2025-22112

commit 919f9f4
Author: Taehee Yoo <ap420073@gmail.com>
Date:   Sun Mar 16 02:58:37 2025 +0000

    eth: bnxt: fix out-of-range access of vnic_info array

    The bnxt_queue_{start | stop}() access vnic_info as much as allocated,
    which indicates bp->nr_vnics.
    So, it should not reach bp->vnic_info[bp->nr_vnics].

    Fixes: 6619585 ("eth: bnxt: do not use BNXT_VNIC_NTUPLE unconditionally in queue restart logic")
    Signed-off-by: Taehee Yoo <ap420073@gmail.com>
    Reviewed-by: Michael Chan <michael.chan@broadcom.com>
    Link: https://patch.msgid.link/20250316025837.939527-1-ap420073@gmail.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>

Signed-off-by: Michal Schmidt <mschmidt@redhat.com>

Author: michich

drivers/net/ethernet/broadcom/bnxt/bnxt.c

@@ -15800,7 +15800,7 @@ static int bnxt_queue_start(struct net_device *dev, void *qmem, int idx)
 	napi_enable(&bnapi->napi);
 	bnxt_db_nq_arm(bp, &cpr->cp_db, cpr->cp_raw_cons);
 
-	for (i = 0; i <= bp->nr_vnics; i++) {
+	for (i = 0; i < bp->nr_vnics; i++) {
 		vnic = &bp->vnic_info[i];
 
 		rc = bnxt_hwrm_vnic_set_rss_p5(bp, vnic, true);
@@ -15834,7 +15834,7 @@ static int bnxt_queue_stop(struct net_device *dev, void *qmem, int idx)
 	struct bnxt_napi *bnapi;
 	int i;
 
-	for (i = 0; i <= bp->nr_vnics; i++) {
+	for (i = 0; i < bp->nr_vnics; i++) {
 		vnic = &bp->vnic_info[i];
 		vnic->mru = 0;
 		bnxt_hwrm_vnic_update(bp, vnic,