net: ena: avoid memory access violation by validating req_id properly
Rx req_id is an index in struct ena_eth_io_rx_cdesc_base.
The driver should validate that the Rx req_id it received from
the device is in range [0, ring_size -1]. Failure to do so could
yield to potential memory access violoation.
The validation was mistakenly done when refilling
the Rx submission queue and not in Rx completion queue.
Fixes: ad974baef2
("net: ena: add support for out of order rx buffers refill")
Signed-off-by: Noam Dagan <ndagan@amazon.com>
Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
e02ae6ed51
commit
30623e1ed1
|
@ -1018,13 +1018,9 @@ static int ena_refill_rx_bufs(struct ena_ring *rx_ring, u32 num)
|
|||
struct ena_rx_buffer *rx_info;
|
||||
|
||||
req_id = rx_ring->free_ids[next_to_use];
|
||||
rc = validate_rx_req_id(rx_ring, req_id);
|
||||
if (unlikely(rc < 0))
|
||||
break;
|
||||
|
||||
rx_info = &rx_ring->rx_buffer_info[req_id];
|
||||
|
||||
|
||||
rc = ena_alloc_rx_page(rx_ring, rx_info,
|
||||
GFP_ATOMIC | __GFP_COMP);
|
||||
if (unlikely(rc < 0)) {
|
||||
|
@ -1379,9 +1375,15 @@ static struct sk_buff *ena_rx_skb(struct ena_ring *rx_ring,
|
|||
struct ena_rx_buffer *rx_info;
|
||||
u16 len, req_id, buf = 0;
|
||||
void *va;
|
||||
int rc;
|
||||
|
||||
len = ena_bufs[buf].len;
|
||||
req_id = ena_bufs[buf].req_id;
|
||||
|
||||
rc = validate_rx_req_id(rx_ring, req_id);
|
||||
if (unlikely(rc < 0))
|
||||
return NULL;
|
||||
|
||||
rx_info = &rx_ring->rx_buffer_info[req_id];
|
||||
|
||||
if (unlikely(!rx_info->page)) {
|
||||
|
@ -1454,6 +1456,11 @@ static struct sk_buff *ena_rx_skb(struct ena_ring *rx_ring,
|
|||
buf++;
|
||||
len = ena_bufs[buf].len;
|
||||
req_id = ena_bufs[buf].req_id;
|
||||
|
||||
rc = validate_rx_req_id(rx_ring, req_id);
|
||||
if (unlikely(rc < 0))
|
||||
return NULL;
|
||||
|
||||
rx_info = &rx_ring->rx_buffer_info[req_id];
|
||||
} while (1);
|
||||
|
||||
|
|
Loading…
Reference in a new issue