Commit 786f19b7 authored Feb 11, 2020 by Arthur Kiyanovski Committed by Greg Kroah-Hartman Mar 05, 2020

net: ena: fix potential crash when rxfh key is NULL



[ Upstream commit 91a65b7d3ed8450f31ab717a65dcb5f9ceb5ab02 ]

When ethtool -X is called without an hkey, ena_com_fill_hash_function()
is called with key=NULL, which is passed to memcpy causing a crash.

This commit fixes this issue by checking key is not NULL.

Fixes: 1738cd3e ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent 7fb440c5

drivers/net/ethernet/amazon/ena/ena_com.c

+9 −8

Original line number	Diff line number	Diff line
		@@ -2075,15 +2075,16 @@ int ena_com_fill_hash_function(struct ena_com_dev *ena_dev,

		switch (func) {
		case ENA_ADMIN_TOEPLITZ:
		if (key_len > sizeof(hash_key->key)) {
		pr_err("key len (%hu) is bigger than the max supported (%zu)\n",
		if (key) {
		if (key_len != sizeof(hash_key->key)) {
		pr_err("key len (%hu) doesn't equal the supported size (%zu)\n",
		key_len, sizeof(hash_key->key));
		return -EINVAL;
		}

		memcpy(hash_key->key, key, key_len);
		rss->hash_init_val = init_val;
		hash_key->keys_num = key_len >> 2;
		}
		break;
		case ENA_ADMIN_CRC32:
		rss->hash_init_val = init_val;