net: ena: avoid memory access violation by validating req_id properly

Rx req_id is an index in struct ena_eth_io_rx_cdesc_base.
The driver should validate that the Rx req_id it received from
the device is in range [0, ring_size -1].  Failure to do so could
yield to potential memory access violoation.
The validation was mistakenly done when refilling
the Rx submission queue and not in Rx completion queue.

Fixes: 9bf7f4ebdc31 ("net: ena: add support for out of order rx buffers refill")
Signed-off-by: Noam Dagan <ndagan@amazon.com>
Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
index 836fda585391e1d9991a2a65f21e043c1db6e9d1..51333a05c14d639c2b44bec73e2e89506d88d088 100644 (file)
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
@@ -1018,13 +1018,9 @@ static int ena_refill_rx_bufs(struct ena_ring *rx_ring, u32 num)
                struct ena_rx_buffer *rx_info;
 
                req_id = rx_ring->free_ids[next_to_use];
-               rc = validate_rx_req_id(rx_ring, req_id);
-               if (unlikely(rc < 0))
-                       break;
 
                rx_info = &rx_ring->rx_buffer_info[req_id];
 
-
                rc = ena_alloc_rx_page(rx_ring, rx_info,
                                       GFP_ATOMIC | __GFP_COMP);
                if (unlikely(rc < 0)) {
@@ -1379,9 +1375,15 @@ static struct sk_buff *ena_rx_skb(struct ena_ring *rx_ring,
        struct ena_rx_buffer *rx_info;
        u16 len, req_id, buf = 0;
        void *va;
+       int rc;
 
        len = ena_bufs[buf].len;
        req_id = ena_bufs[buf].req_id;
+
+       rc = validate_rx_req_id(rx_ring, req_id);
+       if (unlikely(rc < 0))
+               return NULL;
+
        rx_info = &rx_ring->rx_buffer_info[req_id];
 
        if (unlikely(!rx_info->page)) {
@@ -1454,6 +1456,11 @@ static struct sk_buff *ena_rx_skb(struct ena_ring *rx_ring,
                buf++;
                len = ena_bufs[buf].len;
                req_id = ena_bufs[buf].req_id;
+
+               rc = validate_rx_req_id(rx_ring, req_id);
+               if (unlikely(rc < 0))
+                       return NULL;
+
                rx_info = &rx_ring->rx_buffer_info[req_id];
        } while (1);