linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Arthur Kiyanovski <akiyano@amazon.com>,
	Sameeh Jubran <sameehj@amazon.com>,
	"David S . Miller" <davem@davemloft.net>,
	Sasha Levin <sashal@kernel.org>,
	netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.5 40/58] net: ena: ena-com.c: prevent NULL pointer dereference
Date: Sat, 22 Feb 2020 21:21:01 -0500	[thread overview]
Message-ID: <20200223022119.707-40-sashal@kernel.org> (raw)
In-Reply-To: <20200223022119.707-1-sashal@kernel.org>

From: Arthur Kiyanovski <akiyano@amazon.com>

[ Upstream commit c207979f5ae10ed70aff1bb13f39f0736973de99 ]

comp_ctx can be NULL in a very rare case when an admin command is executed
during the execution of ena_remove().

The bug scenario is as follows:

* ena_destroy_device() sets the comp_ctx to be NULL
* An admin command is executed before executing unregister_netdev(),
  this can still happen because our device can still receive callbacks
  from the netdev infrastructure such as ethtool commands.
* When attempting to access the comp_ctx, the bug occurs since it's set
  to NULL

Fix:
Added a check that comp_ctx is not NULL

Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/amazon/ena/ena_com.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
index 74743fd8a1e0a..304531332e70a 100644
--- a/drivers/net/ethernet/amazon/ena/ena_com.c
+++ b/drivers/net/ethernet/amazon/ena/ena_com.c
@@ -200,6 +200,11 @@ static void comp_ctxt_release(struct ena_com_admin_queue *queue,
 static struct ena_comp_ctx *get_comp_ctxt(struct ena_com_admin_queue *queue,
 					  u16 command_id, bool capture)
 {
+	if (unlikely(!queue->comp_ctx)) {
+		pr_err("Completion context is NULL\n");
+		return NULL;
+	}
+
 	if (unlikely(command_id >= queue->q_depth)) {
 		pr_err("command id is larger than the queue size. cmd_id: %u queue size %d\n",
 		       command_id, queue->q_depth);
-- 
2.20.1


  parent reply	other threads:[~2020-02-23  2:34 UTC|newest]

Thread overview: 58+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-02-23  2:20 [PATCH AUTOSEL 5.5 01/58] ipmi:ssif: Handle a possible NULL pointer reference Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 02/58] drm/msm: Set dma maximum segment size for mdss Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 03/58] sched/core: Don't skip remote tick for idle CPUs Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 04/58] timers/nohz: Update NOHZ load in remote tick Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 05/58] sched/fair: Prevent unlimited runtime on throttled group Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 06/58] dax: pass NOWAIT flag to iomap_apply Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 07/58] mac80211: consider more elements in parsing CRC Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 08/58] cfg80211: check wiphy driver existence for drvinfo report Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 09/58] io_uring: flush overflowed CQ events in the io_uring_poll() Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 10/58] s390/zcrypt: fix card and queue total counter wrap Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 11/58] qmi_wwan: re-add DW5821e pre-production variant Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 12/58] qmi_wwan: unconditionally reject 2 ep interfaces Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 13/58] NFSv4: Fix races between open and dentry revalidation Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 14/58] perf/smmuv3: Use platform_get_irq_optional() for wired interrupt Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 15/58] arm/ftrace: Fix BE text poking Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 16/58] sched/psi: Fix OOB write when writing 0 bytes to PSI files Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 17/58] perf/x86/intel: Add Elkhart Lake support Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 18/58] perf/x86/cstate: Add Tremont support Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 19/58] perf/x86/msr: " Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 20/58] ceph: do not execute direct write in parallel if O_APPEND is specified Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 21/58] ARM: dts: sti: fixup sound frame-inversion for stihxxx-b2120.dtsi Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 22/58] drm/amd/display: Do not set optimized_require to false after plane disable Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 23/58] RDMA/siw: Remove unwanted WARN_ON in siw_cm_llp_data_ready() Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 24/58] drm/amd/display: Check engine is not NULL before acquiring Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 25/58] drm/amd/display: Limit minimum DPPCLK to 100MHz Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 26/58] drm/amd/display: Add initialitions for PLL2 clock source Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 27/58] amdgpu: Prevent build errors regarding soft/hard-float FP ABI tags Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 28/58] soc/tegra: fuse: Fix build with Tegra194 configuration Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 29/58] i40e: Fix the conditional for i40e_vc_validate_vqs_bitmaps Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 30/58] net: ena: fix potential crash when rxfh key is NULL Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 31/58] net: ena: fix uses of round_jiffies() Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 32/58] net: ena: add missing ethtool TX timestamping indication Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 33/58] net: ena: fix incorrect default RSS key Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 34/58] net: ena: rss: do not allocate key when not supported Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 35/58] net: ena: rss: fix failure to get indirection table Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 36/58] net: ena: rss: store hash function as values and not bits Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 37/58] net: ena: fix incorrectly saving queue numbers when setting RSS indirection table Sasha Levin
2020-02-23  2:20 ` [PATCH AUTOSEL 5.5 38/58] net: ena: fix corruption of dev_idx_to_host_tbl Sasha Levin
2020-02-23  2:21 ` [PATCH AUTOSEL 5.5 39/58] net: ena: ethtool: use correct value for crc32 hash Sasha Levin
2020-02-23  2:21 ` Sasha Levin [this message]
2020-02-23  2:21 ` [PATCH AUTOSEL 5.5 41/58] enic: prevent waking up stopped tx queues over watchdog reset Sasha Levin
2020-02-23  2:21 ` [PATCH AUTOSEL 5.5 42/58] ice: Fix switch between FW and SW LLDP Sasha Levin
2020-02-23  2:21 ` [PATCH AUTOSEL 5.5 43/58] ice: Don't allow same value for Rx tail to be written twice Sasha Levin
2020-02-23  2:21 ` [PATCH AUTOSEL 5.5 44/58] ice: fix and consolidate logging of NVM/firmware version information Sasha Levin
2020-02-23  2:21 ` [PATCH AUTOSEL 5.5 45/58] ice: update Unit Load Status bitmask to check after reset Sasha Levin
2020-02-23  2:21 ` [PATCH AUTOSEL 5.5 46/58] ice: Use ice_pf_to_dev Sasha Levin
2020-02-23  2:21 ` [PATCH AUTOSEL 5.5 47/58] ice: Use correct netif error function Sasha Levin
2020-02-23  2:21 ` [PATCH AUTOSEL 5.5 48/58] io-wq: don't call kXalloc_node() with non-online node Sasha Levin
2020-02-23  2:21 ` [PATCH AUTOSEL 5.5 49/58] cifs: Fix mode output in debugging statements Sasha Levin
2020-02-23  2:21 ` [PATCH AUTOSEL 5.5 50/58] bcache: ignore pending signals when creating gc and allocator thread Sasha Levin
2020-02-23  2:21 ` [PATCH AUTOSEL 5.5 51/58] cfg80211: add missing policy for NL80211_ATTR_STATUS_CODE Sasha Levin
2020-02-23  2:21 ` [PATCH AUTOSEL 5.5 52/58] mac80211: fix wrong 160/80+80 MHz setting Sasha Levin
2020-02-23  2:21 ` [PATCH AUTOSEL 5.5 53/58] net: hns3: add management table after IMP reset Sasha Levin
2020-02-23  2:21 ` [PATCH AUTOSEL 5.5 54/58] net: hns3: fix VF bandwidth does not take effect in some case Sasha Levin
2020-02-23  2:21 ` [PATCH AUTOSEL 5.5 55/58] net: hns3: fix a copying IPv6 address error in hclge_fd_get_flow_tuples() Sasha Levin
2020-02-23  2:21 ` [PATCH AUTOSEL 5.5 56/58] nvme/tcp: fix bug on double requeue when send fails Sasha Levin
2020-02-23  2:21 ` [PATCH AUTOSEL 5.5 57/58] nvme: prevent warning triggered by nvme_stop_keep_alive Sasha Levin
2020-02-23  2:21 ` [PATCH AUTOSEL 5.5 58/58] nvme/pci: move cqe check after device shutdown Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200223022119.707-40-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=akiyano@amazon.com \
    --cc=davem@davemloft.net \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=sameehj@amazon.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).