diff options
| author | Arthur Kiyanovski <akiyano@amazon.com> | 2020-02-11 16:17:51 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2020-02-12 02:08:31 +0100 |
| commit | c207979f5ae10ed70aff1bb13f39f0736973de99 (patch) | |
| tree | 5635ba5e41e1cd608c8ad4977c18bdadee3fe588 /drivers/net/ethernet/amazon | |
| parent | net: ena: ethtool: use correct value for crc32 hash (diff) | |
| download | linux-c207979f5ae10ed70aff1bb13f39f0736973de99.tar.xz linux-c207979f5ae10ed70aff1bb13f39f0736973de99.zip | |
net: ena: ena-com.c: prevent NULL pointer dereference
comp_ctx can be NULL in a very rare case when an admin command is executed
during the execution of ena_remove().
The bug scenario is as follows:
* ena_destroy_device() sets the comp_ctx to be NULL
* An admin command is executed before executing unregister_netdev(),
this can still happen because our device can still receive callbacks
from the netdev infrastructure such as ethtool commands.
* When attempting to access the comp_ctx, the bug occurs since it's set
to NULL
Fix:
Added a check that comp_ctx is not NULL
Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet/amazon')
| -rw-r--r-- | drivers/net/ethernet/amazon/ena/ena_com.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c index 0f93d1092435..1fb58f9ad80b 100644 --- a/drivers/net/ethernet/amazon/ena/ena_com.c +++ b/drivers/net/ethernet/amazon/ena/ena_com.c @@ -200,6 +200,11 @@ static void comp_ctxt_release(struct ena_com_admin_queue *queue, static struct ena_comp_ctx *get_comp_ctxt(struct ena_com_admin_queue *queue, u16 command_id, bool capture) { + if (unlikely(!queue->comp_ctx)) { + pr_err("Completion context is NULL\n"); + return NULL; + } + if (unlikely(command_id >= queue->q_depth)) { pr_err("command id is larger than the queue size. cmd_id: %u queue size %d\n", command_id, queue->q_depth); |