lkml.org 
[lkml]   [2018]   [Jan]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH net-next] ptr_ring: fix integer overflow
    Date
    We try to allocate one more entry for lockless peeking. The adding
    operation may overflow which causes zero to be passed to kmalloc().
    In this case, it returns ZERO_SIZE_PTR without any notice by ptr
    ring. Try to do producing or consuming on such ring will lead NULL
    dereference. Fix this detect and fail early.

    Fixes: bcecb4bbf88a ("net: ptr_ring: otherwise safe empty checks can overrun array bounds")
    Reported-by: syzbot+87678bcf753b44c39b67@syzkaller.appspotmail.com
    Cc: John Fastabend <john.fastabend@gmail.com>
    Signed-off-by: Jason Wang <jasowang@redhat.com>
    ---
    include/linux/ptr_ring.h | 2 ++
    1 file changed, 2 insertions(+)

    diff --git a/include/linux/ptr_ring.h b/include/linux/ptr_ring.h
    index 9ca1726..3f99484 100644
    --- a/include/linux/ptr_ring.h
    +++ b/include/linux/ptr_ring.h
    @@ -453,6 +453,8 @@ static inline int ptr_ring_consume_batched_bh(struct ptr_ring *r,

    static inline void **__ptr_ring_init_queue_alloc(unsigned int size, gfp_t gfp)
    {
    + if (unlikely(size + 1 == 0))
    + return NULL;
    /* Allocate an extra dummy element at end of ring to avoid consumer head
    * or produce head access past the end of the array. Possible when
    * producer/consumer operations and __ptr_ring_peek operations run in
    --
    2.7.4
    \
     
     \ /
      Last update: 2018-01-25 08:32    [W:4.406 / U:4.796 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site