• Arthur Kiyanovski's avatar
    net: ena: fix corruption of dev_idx_to_host_tbl · e3f89f91
    Arthur Kiyanovski authored
    The function ena_com_ind_tbl_convert_from_device() has an overflow
    bug as explained below. Either way, this function is not needed at
    all since we don't retrieve the indirection table from the device
    at any point which means that this conversion is not needed.
    
    The bug:
    The for loop iterates over all io_sq_queues, when passing the actual
    number of used queues the io_sq_queues[i].idx equals 0 since they are
    uninitialized which results in the following code to be executed till
    the end of the loop:
    
    dev_idx_to_host_tbl[0] = i;
    
    This results dev_idx_to_host_tbl[0] in being equal to
    ENA_TOTAL_NUM_QUEUES - 1.
    
    Fixes: 1738cd3e ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
    Signed-off-by: default avatarSameeh Jubran <sameehj@amazon.com>
    Signed-off-by: default avatarArthur Kiyanovski <akiyano@amazon.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    e3f89f91
ena_com.c 80.1 KB