lkml.org 
[lkml]   [2020]   [Feb]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.4 39/50] net: ena: ena-com.c: prevent NULL pointer dereference
    Date
    From: Arthur Kiyanovski <akiyano@amazon.com>

    [ Upstream commit c207979f5ae10ed70aff1bb13f39f0736973de99 ]

    comp_ctx can be NULL in a very rare case when an admin command is executed
    during the execution of ena_remove().

    The bug scenario is as follows:

    * ena_destroy_device() sets the comp_ctx to be NULL
    * An admin command is executed before executing unregister_netdev(),
    this can still happen because our device can still receive callbacks
    from the netdev infrastructure such as ethtool commands.
    * When attempting to access the comp_ctx, the bug occurs since it's set
    to NULL

    Fix:
    Added a check that comp_ctx is not NULL

    Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
    Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
    Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/ethernet/amazon/ena/ena_com.c | 5 +++++
    1 file changed, 5 insertions(+)

    diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
    index 74743fd8a1e0a..304531332e70a 100644
    --- a/drivers/net/ethernet/amazon/ena/ena_com.c
    +++ b/drivers/net/ethernet/amazon/ena/ena_com.c
    @@ -200,6 +200,11 @@ static void comp_ctxt_release(struct ena_com_admin_queue *queue,
    static struct ena_comp_ctx *get_comp_ctxt(struct ena_com_admin_queue *queue,
    u16 command_id, bool capture)
    {
    + if (unlikely(!queue->comp_ctx)) {
    + pr_err("Completion context is NULL\n");
    + return NULL;
    + }
    +
    if (unlikely(command_id >= queue->q_depth)) {
    pr_err("command id is larger than the queue size. cmd_id: %u queue size %d\n",
    command_id, queue->q_depth);
    --
    2.20.1
    \
     
     \ /
      Last update: 2020-02-23 03:23    [W:5.368 / U:0.036 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site