Commit 9fb582b6 authored Jan 26, 2018 by Michael S. Tsirkin Committed by David S. Miller Jan 29, 2018

Revert "net: ptr_ring: otherwise safe empty checks can overrun array bounds"



This reverts commit bcecb4bb.

If we try to allocate an extra entry as the above commit did, and when
the requested size is UINT_MAX, addition overflows causing zero size to
be passed to kmalloc().

kmalloc then returns ZERO_SIZE_PTR with a subsequent crash.

Reported-by:  <syzbot+87678bcf753b44c39b67@syzkaller.appspotmail.com>
Cc: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 84328342

include/linux/ptr_ring.h

+1 −6

Original line number	Diff line number	Diff line
		@@ -466,12 +466,7 @@ static inline int ptr_ring_consume_batched_bh(struct ptr_ring *r,

		static inline void **__ptr_ring_init_queue_alloc(unsigned int size, gfp_t gfp)
		{
		/* Allocate an extra dummy element at end of ring to avoid consumer head
		* or produce head access past the end of the array. Possible when
		* producer/consumer operations and __ptr_ring_peek operations run in
		* parallel.
		*/
		return kcalloc(size + 1, sizeof(void *), gfp);
		return kcalloc(size, sizeof(void *), gfp);
		}

		static inline void __ptr_ring_set_size(struct ptr_ring *r, int size)