net: ena: fix potential crash when rxfh key is NULL

When ethtool -X is called without an hkey, ena_com_fill_hash_function()
is called with key=NULL, which is passed to memcpy causing a crash.

This commit fixes this issue by checking key is not NULL.

Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
index ea62604..e54c44f 100644 (file)
--- a/drivers/net/ethernet/amazon/ena/ena_com.c
+++ b/drivers/net/ethernet/amazon/ena/ena_com.c
@@ -2297,15 +2297,16 @@ int ena_com_fill_hash_function(struct ena_com_dev *ena_dev,
 
        switch (func) {
        case ENA_ADMIN_TOEPLITZ:
-               if (key_len > sizeof(hash_key->key)) {
-                       pr_err("key len (%hu) is bigger than the max supported (%zu)\n",
-                              key_len, sizeof(hash_key->key));
-                       return -EINVAL;
+               if (key) {
+                       if (key_len != sizeof(hash_key->key)) {
+                               pr_err("key len (%hu) doesn't equal the supported size (%zu)\n",
+                                      key_len, sizeof(hash_key->key));
+                               return -EINVAL;
+                       }
+                       memcpy(hash_key->key, key, key_len);
+                       rss->hash_init_val = init_val;
+                       hash_key->keys_num = key_len >> 2;
                }
-
-               memcpy(hash_key->key, key, key_len);
-               rss->hash_init_val = init_val;
-               hash_key->keys_num = key_len >> 2;
                break;
        case ENA_ADMIN_CRC32:
                rss->hash_init_val = init_val;