| From 3ea649786d30ad6a6ea9f667cd33f2c5ccc49c08 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 11 Feb 2020 15:17:40 +0000 |
| Subject: net: ena: fix potential crash when rxfh key is NULL |
| |
| From: Arthur Kiyanovski <akiyano@amazon.com> |
| |
| [ Upstream commit 91a65b7d3ed8450f31ab717a65dcb5f9ceb5ab02 ] |
| |
| When ethtool -X is called without an hkey, ena_com_fill_hash_function() |
| is called with key=NULL, which is passed to memcpy causing a crash. |
| |
| This commit fixes this issue by checking key is not NULL. |
| |
| Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") |
| Signed-off-by: Sameeh Jubran <sameehj@amazon.com> |
| Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/net/ethernet/amazon/ena/ena_com.c | 17 +++++++++-------- |
| 1 file changed, 9 insertions(+), 8 deletions(-) |
| |
| diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c |
| index ea62604fdf8ca..e54c44fdcaa73 100644 |
| --- a/drivers/net/ethernet/amazon/ena/ena_com.c |
| +++ b/drivers/net/ethernet/amazon/ena/ena_com.c |
| @@ -2297,15 +2297,16 @@ int ena_com_fill_hash_function(struct ena_com_dev *ena_dev, |
| |
| switch (func) { |
| case ENA_ADMIN_TOEPLITZ: |
| - if (key_len > sizeof(hash_key->key)) { |
| - pr_err("key len (%hu) is bigger than the max supported (%zu)\n", |
| - key_len, sizeof(hash_key->key)); |
| - return -EINVAL; |
| + if (key) { |
| + if (key_len != sizeof(hash_key->key)) { |
| + pr_err("key len (%hu) doesn't equal the supported size (%zu)\n", |
| + key_len, sizeof(hash_key->key)); |
| + return -EINVAL; |
| + } |
| + memcpy(hash_key->key, key, key_len); |
| + rss->hash_init_val = init_val; |
| + hash_key->keys_num = key_len >> 2; |
| } |
| - |
| - memcpy(hash_key->key, key, key_len); |
| - rss->hash_init_val = init_val; |
| - hash_key->keys_num = key_len >> 2; |
| break; |
| case ENA_ADMIN_CRC32: |
| rss->hash_init_val = init_val; |
| -- |
| 2.20.1 |
| |