| From 75d1d1e21acae5434e4ce07b69fa68e5d5adb55f Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 11 Feb 2020 15:17:48 +0000 |
| Subject: net: ena: fix corruption of dev_idx_to_host_tbl |
| |
| From: Arthur Kiyanovski <akiyano@amazon.com> |
| |
| [ Upstream commit e3f89f91e98ce07dc0f121a3b70d21aca749ba39 ] |
| |
| The function ena_com_ind_tbl_convert_from_device() has an overflow |
| bug as explained below. Either way, this function is not needed at |
| all since we don't retrieve the indirection table from the device |
| at any point which means that this conversion is not needed. |
| |
| The bug: |
| The for loop iterates over all io_sq_queues, when passing the actual |
| number of used queues the io_sq_queues[i].idx equals 0 since they are |
| uninitialized which results in the following code to be executed till |
| the end of the loop: |
| |
| dev_idx_to_host_tbl[0] = i; |
| |
| This results dev_idx_to_host_tbl[0] in being equal to |
| ENA_TOTAL_NUM_QUEUES - 1. |
| |
| Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") |
| Signed-off-by: Sameeh Jubran <sameehj@amazon.com> |
| Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/net/ethernet/amazon/ena/ena_com.c | 28 ----------------------- |
| 1 file changed, 28 deletions(-) |
| |
| diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c |
| index 8ab192cb26b74..74743fd8a1e0a 100644 |
| --- a/drivers/net/ethernet/amazon/ena/ena_com.c |
| +++ b/drivers/net/ethernet/amazon/ena/ena_com.c |
| @@ -1281,30 +1281,6 @@ static int ena_com_ind_tbl_convert_to_device(struct ena_com_dev *ena_dev) |
| return 0; |
| } |
| |
| -static int ena_com_ind_tbl_convert_from_device(struct ena_com_dev *ena_dev) |
| -{ |
| - u16 dev_idx_to_host_tbl[ENA_TOTAL_NUM_QUEUES] = { (u16)-1 }; |
| - struct ena_rss *rss = &ena_dev->rss; |
| - u8 idx; |
| - u16 i; |
| - |
| - for (i = 0; i < ENA_TOTAL_NUM_QUEUES; i++) |
| - dev_idx_to_host_tbl[ena_dev->io_sq_queues[i].idx] = i; |
| - |
| - for (i = 0; i < 1 << rss->tbl_log_size; i++) { |
| - if (rss->rss_ind_tbl[i].cq_idx > ENA_TOTAL_NUM_QUEUES) |
| - return -EINVAL; |
| - idx = (u8)rss->rss_ind_tbl[i].cq_idx; |
| - |
| - if (dev_idx_to_host_tbl[idx] > ENA_TOTAL_NUM_QUEUES) |
| - return -EINVAL; |
| - |
| - rss->host_rss_ind_tbl[i] = dev_idx_to_host_tbl[idx]; |
| - } |
| - |
| - return 0; |
| -} |
| - |
| static void ena_com_update_intr_delay_resolution(struct ena_com_dev *ena_dev, |
| u16 intr_delay_resolution) |
| { |
| @@ -2638,10 +2614,6 @@ int ena_com_indirect_table_get(struct ena_com_dev *ena_dev, u32 *ind_tbl) |
| if (!ind_tbl) |
| return 0; |
| |
| - rc = ena_com_ind_tbl_convert_from_device(ena_dev); |
| - if (unlikely(rc)) |
| - return rc; |
| - |
| for (i = 0; i < (1 << rss->tbl_log_size); i++) |
| ind_tbl[i] = rss->host_rss_ind_tbl[i]; |
| |
| -- |
| 2.20.1 |
| |