]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
net: ena: fix corruption of dev_idx_to_host_tbl
authorArthur Kiyanovski <akiyano@amazon.com>
Tue, 11 Feb 2020 15:17:48 +0000 (15:17 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 5 Mar 2020 15:45:10 +0000 (16:45 +0100)
commite83967dd4f63a38c0af558109fa24b906d97d968
treed201a80c8ed8196b626f3a1793bde3b101dd2b4a
parent2aec2558b24c8de1c0bd8270690d889c02d05cdb
net: ena: fix corruption of dev_idx_to_host_tbl

[ Upstream commit e3f89f91e98ce07dc0f121a3b70d21aca749ba39 ]

The function ena_com_ind_tbl_convert_from_device() has an overflow
bug as explained below. Either way, this function is not needed at
all since we don't retrieve the indirection table from the device
at any point which means that this conversion is not needed.

The bug:
The for loop iterates over all io_sq_queues, when passing the actual
number of used queues the io_sq_queues[i].idx equals 0 since they are
uninitialized which results in the following code to be executed till
the end of the loop:

dev_idx_to_host_tbl[0] = i;

This results dev_idx_to_host_tbl[0] in being equal to
ENA_TOTAL_NUM_QUEUES - 1.

Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/ethernet/amazon/ena/ena_com.c