Skip to content

Commit 91a65b7

Browse files
akiyanodavem330
authored andcommitted
net: ena: fix potential crash when rxfh key is NULL
When ethtool -X is called without an hkey, ena_com_fill_hash_function() is called with key=NULL, which is passed to memcpy causing a crash. This commit fixes this issue by checking key is not NULL. Fixes: 1738cd3 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") Signed-off-by: Sameeh Jubran <[email protected]> Signed-off-by: Arthur Kiyanovski <[email protected]> Signed-off-by: David S. Miller <[email protected]>
1 parent 457fed7 commit 91a65b7

File tree

1 file changed

+9
-8
lines changed

1 file changed

+9
-8
lines changed

drivers/net/ethernet/amazon/ena/ena_com.c

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2297,15 +2297,16 @@ int ena_com_fill_hash_function(struct ena_com_dev *ena_dev,
22972297

22982298
switch (func) {
22992299
case ENA_ADMIN_TOEPLITZ:
2300-
if (key_len > sizeof(hash_key->key)) {
2301-
pr_err("key len (%hu) is bigger than the max supported (%zu)\n",
2302-
key_len, sizeof(hash_key->key));
2303-
return -EINVAL;
2300+
if (key) {
2301+
if (key_len != sizeof(hash_key->key)) {
2302+
pr_err("key len (%hu) doesn't equal the supported size (%zu)\n",
2303+
key_len, sizeof(hash_key->key));
2304+
return -EINVAL;
2305+
}
2306+
memcpy(hash_key->key, key, key_len);
2307+
rss->hash_init_val = init_val;
2308+
hash_key->keys_num = key_len >> 2;
23042309
}
2305-
2306-
memcpy(hash_key->key, key, key_len);
2307-
rss->hash_init_val = init_val;
2308-
hash_key->keys_num = key_len >> 2;
23092310
break;
23102311
case ENA_ADMIN_CRC32:
23112312
rss->hash_init_val = init_val;

0 commit comments

Comments
 (0)