Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 84328342 authored by Michael S. Tsirkin's avatar Michael S. Tsirkin Committed by David S. Miller
Browse files

ptr_ring: disallow lockless __ptr_ring_full 



Similar to bcecb4bb ("net: ptr_ring: otherwise safe empty checks can
overrun array bounds") a lockless use of __ptr_ring_full might
cause an out of bounds access.

We can fix this, but it's easier to just disallow lockless
__ptr_ring_full for now.

Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 88fae873

include/linux/ptr_ring.h

+4 −3
Original line number Diff line number Diff line
@@ -45,9 +45,10 @@ struct ptr_ring { 
};



/* Note: callers invoking this in a loop must use a compiler barrier,

 * for example cpu_relax().  If ring is ever resized, callers must hold

 * producer_lock - see e.g. ptr_ring_full.  Otherwise, if callers don't hold

 * producer_lock, the next call to __ptr_ring_produce may fail.

 * for example cpu_relax().

 *

 * NB: this is unlike __ptr_ring_empty in that callers must hold producer_lock:

 * see e.g. ptr_ring_full.

 */

static inline bool __ptr_ring_full(struct ptr_ring *r)

{