lkml.org 
[lkml]   [2020]   [Mar]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.5 049/170] net: ena: avoid memory access violation by validating req_id properly
    Date
    From: Arthur Kiyanovski <akiyano@amazon.com>

    [ Upstream commit 30623e1ed116bcd1785217d0a98eec643687e091 ]

    Rx req_id is an index in struct ena_eth_io_rx_cdesc_base.
    The driver should validate that the Rx req_id it received from
    the device is in range [0, ring_size -1]. Failure to do so could
    yield to potential memory access violoation.
    The validation was mistakenly done when refilling
    the Rx submission queue and not in Rx completion queue.

    Fixes: ad974baef2a1 ("net: ena: add support for out of order rx buffers refill")
    Signed-off-by: Noam Dagan <ndagan@amazon.com>
    Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/net/ethernet/amazon/ena/ena_netdev.c | 15 +++++++++++----
    1 file changed, 11 insertions(+), 4 deletions(-)

    --- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
    +++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
    @@ -532,13 +532,9 @@ static int ena_refill_rx_bufs(struct ena
    struct ena_rx_buffer *rx_info;

    req_id = rx_ring->free_ids[next_to_use];
    - rc = validate_rx_req_id(rx_ring, req_id);
    - if (unlikely(rc < 0))
    - break;

    rx_info = &rx_ring->rx_buffer_info[req_id];

    -
    rc = ena_alloc_rx_page(rx_ring, rx_info,
    GFP_ATOMIC | __GFP_COMP);
    if (unlikely(rc < 0)) {
    @@ -868,9 +864,15 @@ static struct sk_buff *ena_rx_skb(struct
    struct ena_rx_buffer *rx_info;
    u16 len, req_id, buf = 0;
    void *va;
    + int rc;

    len = ena_bufs[buf].len;
    req_id = ena_bufs[buf].req_id;
    +
    + rc = validate_rx_req_id(rx_ring, req_id);
    + if (unlikely(rc < 0))
    + return NULL;
    +
    rx_info = &rx_ring->rx_buffer_info[req_id];

    if (unlikely(!rx_info->page)) {
    @@ -943,6 +945,11 @@ static struct sk_buff *ena_rx_skb(struct
    buf++;
    len = ena_bufs[buf].len;
    req_id = ena_bufs[buf].req_id;
    +
    + rc = validate_rx_req_id(rx_ring, req_id);
    + if (unlikely(rc < 0))
    + return NULL;
    +
    rx_info = &rx_ring->rx_buffer_info[req_id];
    } while (1);


    \
     
     \ /
      Last update: 2020-03-31 11:04    [W:4.078 / U:0.336 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site