OSDN Git Service

net: ena: handle bad request id in ena_netdev
authorShay Agroskin <shayagr@amazon.com>
Mon, 23 Nov 2020 19:08:57 +0000 (21:08 +0200)
committerJakub Kicinski <kuba@kernel.org>
Wed, 25 Nov 2020 00:07:13 +0000 (16:07 -0800)
commit5b7022cf1dc0d721bd4b5f3bada05bd8ced82fe0
treee482973b120cbc8c754033d915cb14ce687cae41
parentd8f0a86795c69f5b697f7d9e5274c124da93c92d
net: ena: handle bad request id in ena_netdev

After request id is checked in validate_rx_req_id() its value is still
used in the line
rx_ring->free_ids[next_to_clean] =
rx_ring->ena_bufs[i].req_id;
even if it was found to be out-of-bound for the array free_ids.

The patch moves the request id to an earlier stage in the napi routine and
makes sure its value isn't used if it's found out-of-bounds.

Fixes: 30623e1ed116 ("net: ena: avoid memory access violation by validating req_id properly")
Signed-off-by: Ido Segev <idose@amazon.com>
Signed-off-by: Shay Agroskin <shayagr@amazon.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
drivers/net/ethernet/amazon/ena/ena_eth_com.c
drivers/net/ethernet/amazon/ena/ena_netdev.c