| From 215d3d1cce40ce8a6c664b68eb79ac443c0bee9a Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 11 Feb 2020 15:17:51 +0000 |
| Subject: net: ena: ena-com.c: prevent NULL pointer dereference |
| |
| From: Arthur Kiyanovski <akiyano@amazon.com> |
| |
| [ Upstream commit c207979f5ae10ed70aff1bb13f39f0736973de99 ] |
| |
| comp_ctx can be NULL in a very rare case when an admin command is executed |
| during the execution of ena_remove(). |
| |
| The bug scenario is as follows: |
| |
| * ena_destroy_device() sets the comp_ctx to be NULL |
| * An admin command is executed before executing unregister_netdev(), |
| this can still happen because our device can still receive callbacks |
| from the netdev infrastructure such as ethtool commands. |
| * When attempting to access the comp_ctx, the bug occurs since it's set |
| to NULL |
| |
| Fix: |
| Added a check that comp_ctx is not NULL |
| |
| Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") |
| Signed-off-by: Sameeh Jubran <sameehj@amazon.com> |
| Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/net/ethernet/amazon/ena/ena_com.c | 5 +++++ |
| 1 file changed, 5 insertions(+) |
| |
| diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c |
| index 74743fd8a1e0a..304531332e70a 100644 |
| --- a/drivers/net/ethernet/amazon/ena/ena_com.c |
| +++ b/drivers/net/ethernet/amazon/ena/ena_com.c |
| @@ -200,6 +200,11 @@ static void comp_ctxt_release(struct ena_com_admin_queue *queue, |
| static struct ena_comp_ctx *get_comp_ctxt(struct ena_com_admin_queue *queue, |
| u16 command_id, bool capture) |
| { |
| + if (unlikely(!queue->comp_ctx)) { |
| + pr_err("Completion context is NULL\n"); |
| + return NULL; |
| + } |
| + |
| if (unlikely(command_id >= queue->q_depth)) { |
| pr_err("command id is larger than the queue size. cmd_id: %u queue size %d\n", |
| command_id, queue->q_depth); |
| -- |
| 2.20.1 |
| |