]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
net: ena: handle bad request id in ena_netdev
authorShay Agroskin <shayagr@amazon.com>
Mon, 23 Nov 2020 19:08:57 +0000 (21:08 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 2 Dec 2020 07:51:57 +0000 (08:51 +0100)
commit2f7b0f3a744f7c3e956898dd9b4b6fbb79b50f3e
treecfaada6bc3292d9672851d605fe68ed57de254be
parentb7fc59ca8a2bdc342cfdb6f30882151b13c22f33
net: ena: handle bad request id in ena_netdev

[ Upstream commit 5b7022cf1dc0d721bd4b5f3bada05bd8ced82fe0 ]

After request id is checked in validate_rx_req_id() its value is still
used in the line
rx_ring->free_ids[next_to_clean] =
rx_ring->ena_bufs[i].req_id;
even if it was found to be out-of-bound for the array free_ids.

The patch moves the request id to an earlier stage in the napi routine and
makes sure its value isn't used if it's found out-of-bounds.

Fixes: 30623e1ed116 ("net: ena: avoid memory access violation by validating req_id properly")
Signed-off-by: Ido Segev <idose@amazon.com>
Signed-off-by: Shay Agroskin <shayagr@amazon.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/ethernet/amazon/ena/ena_eth_com.c
drivers/net/ethernet/amazon/ena/ena_netdev.c