]> git.baikalelectronics.ru Git - kernel.git/commit
net: ena: avoid memory access violation by validating req_id properly
authorArthur Kiyanovski <akiyano@amazon.com>
Tue, 17 Mar 2020 07:06:41 +0000 (09:06 +0200)
committerDavid S. Miller <davem@davemloft.net>
Wed, 18 Mar 2020 04:24:23 +0000 (21:24 -0700)
commit6b56d5708b6b1db7e434710a637959a28ae7c4d5
tree1114209c17300a10726665b802605100eaeb123e
parentc51dc8ce1e22a8a47825ecd96d1b140f625778de
net: ena: avoid memory access violation by validating req_id properly

Rx req_id is an index in struct ena_eth_io_rx_cdesc_base.
The driver should validate that the Rx req_id it received from
the device is in range [0, ring_size -1].  Failure to do so could
yield to potential memory access violoation.
The validation was mistakenly done when refilling
the Rx submission queue and not in Rx completion queue.

Fixes: e4adf18ebbd6 ("net: ena: add support for out of order rx buffers refill")
Signed-off-by: Noam Dagan <ndagan@amazon.com>
Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/ethernet/amazon/ena/ena_netdev.c