net: ena: handle bad request id in ena_netdev

Browse source

After request id is checked in validate_rx_req_id() its value is still
used in the line
	rx_ring->free_ids[next_to_clean] =
					rx_ring->ena_bufs[i].req_id;
even if it was found to be out-of-bound for the array free_ids.

The patch moves the request id to an earlier stage in the napi routine and
makes sure its value isn't used if it's found out-of-bounds.

Fixes: 30623e1ed1 ("net: ena: avoid memory access violation by validating req_id properly")
Signed-off-by: Ido Segev <idose@amazon.com>
Signed-off-by: Shay Agroskin <shayagr@amazon.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

...

This commit is contained in:

Shay Agroskin 2020-11-23 21:08:57 +02:00 • committed by Jakub Kicinski

parent d8f0a86795

commit 5b7022cf1d

2 changed files with 14 additions and 32 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

3

drivers/net/ethernet/amazon/ena/ena_eth_com.c

View file

43

drivers/net/ethernet/amazon/ena/ena_netdev.c

View file