⬢ DragonFlyBSD Kernel Audit
DF-1294 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
diff --git a/sys/dev/virtual/amazon/ena/ena-com/ena_com.c b/sys/dev/virtual/amazon/ena/ena-com/ena_com.c
--- a/sys/dev/virtual/amazon/ena/ena-com/ena_com.c
+++ b/sys/dev/virtual/amazon/ena/ena-com/ena_com.c
@@ -1154,6 +1154,10 @@
 	}
 
 	io_sq->idx = cmd_completion.sq_idx;
+	if (unlikely(io_sq->idx >= ENA_TOTAL_NUM_QUEUES)) {
+		ena_trc_err("sq_idx [%u] out of range\n", io_sq->idx);
+		return ENA_COM_INVAL;
+	}
 
 	io_sq->db_addr = (u32 __iomem *)((uintptr_t)ena_dev->reg_bar +
 		(uintptr_t)cmd_completion.sq_doorbell_offset);
@@ -1202,8 +1206,12 @@
 	u8 idx;
 	u16 i;
 
-	for (i = 0; i < ENA_TOTAL_NUM_QUEUES; i++)
-		dev_idx_to_host_tbl[ena_dev->io_sq_queues[i].idx] = i;
+	for (i = 0; i < ENA_TOTAL_NUM_QUEUES; i++) {
+		u16 idx = ena_dev->io_sq_queues[i].idx;
+		if (unlikely(idx >= ENA_TOTAL_NUM_QUEUES))
+			return ENA_COM_INVAL;
+		dev_idx_to_host_tbl[idx] = i;
+	}
 
 	for (i = 0; i < 1 << rss->tbl_log_size; i++) {
 		if (rss->rss_ind_tbl[i].cq_idx > ENA_TOTAL_NUM_QUEUES)
@@ -1331,6 +1339,10 @@
 	}
 
 	io_cq->idx = cmd_completion.cq_idx;
+	if (unlikely(io_cq->idx >= ENA_TOTAL_NUM_QUEUES)) {
+		ena_trc_err("cq_idx [%u] out of range\n", io_cq->idx);
+		return ENA_COM_INVAL;
+	}
 
 	io_cq->unmask_reg = (u32 __iomem *)((uintptr_t)ena_dev->reg_bar +
 		cmd_completion.cq_interrupt_unmask_register_offset);