]> git.baikalelectronics.ru Git - kernel.git/commit
Revert "net: ptr_ring: otherwise safe empty checks can overrun array bounds"
authorMichael S. Tsirkin <mst@redhat.com>
Thu, 25 Jan 2018 23:36:35 +0000 (01:36 +0200)
committerDavid S. Miller <davem@davemloft.net>
Mon, 29 Jan 2018 17:02:54 +0000 (12:02 -0500)
commitcbe124fd4389c0173d5f6db512ab9dd84005b2ec
treec2be3e6f9bc8cde4512dbb7871fcc5801c9f45c2
parent0709fd9ae96d83cf9394cb14d149b95ad4d6ef35
Revert "net: ptr_ring: otherwise safe empty checks can overrun array bounds"

This reverts commit 7163f0973e2f3ed6af40e51ea4ca526269f6233b.

If we try to allocate an extra entry as the above commit did, and when
the requested size is UINT_MAX, addition overflows causing zero size to
be passed to kmalloc().

kmalloc then returns ZERO_SIZE_PTR with a subsequent crash.

Reported-by: syzbot+87678bcf753b44c39b67@syzkaller.appspotmail.com
Cc: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
include/linux/ptr_ring.h