net: ena: avoid memory access violation by validating req_id properly (30623e1e) · Commits · 戴 / test

Rx req_id is an index in struct ena_eth_io_rx_cdesc_base. The driver should validate that the Rx req_id it received from the device is in range [0, ring_size -1]. Failure to do so could yield to potential memory access violoation. The validation was mistakenly done when refilling the Rx submission queue and not in Rx completion queue. Fixes: ("net: ena: add support for out of order rx buffers refill") Signed-off-by:

Noam Dagan <ndagan@amazon.com> Signed-off-by:

Arthur Kiyanovski <akiyano@amazon.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

drivers/net/ethernet/amazon/ena/ena_netdev.c

+11 −4

Original line number	Diff line number	Diff line
		@@ -1018,13 +1018,9 @@ static int ena_refill_rx_bufs(struct ena_ring *rx_ring, u32 num)
		struct ena_rx_buffer *rx_info;

		req_id = rx_ring->free_ids[next_to_use];
		rc = validate_rx_req_id(rx_ring, req_id);
		if (unlikely(rc < 0))
		break;

		rx_info = &rx_ring->rx_buffer_info[req_id];


		rc = ena_alloc_rx_page(rx_ring, rx_info,
		GFP_ATOMIC \| __GFP_COMP);
		if (unlikely(rc < 0)) {
		@@ -1379,9 +1375,15 @@ static struct sk_buff ena_rx_skb(struct ena_ring rx_ring,
		struct ena_rx_buffer *rx_info;
		u16 len, req_id, buf = 0;
		void *va;
		int rc;

		len = ena_bufs[buf].len;
		req_id = ena_bufs[buf].req_id;

		rc = validate_rx_req_id(rx_ring, req_id);
		if (unlikely(rc < 0))
		return NULL;

		rx_info = &rx_ring->rx_buffer_info[req_id];

		if (unlikely(!rx_info->page)) {
		@@ -1454,6 +1456,11 @@ static struct sk_buff ena_rx_skb(struct ena_ring rx_ring,
		buf++;
		len = ena_bufs[buf].len;
		req_id = ena_bufs[buf].req_id;

		rc = validate_rx_req_id(rx_ring, req_id);
		if (unlikely(rc < 0))
		return NULL;

		rx_info = &rx_ring->rx_buffer_info[req_id];
		} while (1);

Admin message