From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751633AbeAYORv (ORCPT ); Thu, 25 Jan 2018 09:17:51 -0500 Received: from mx1.redhat.com ([209.132.183.28]:60404 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751580AbeAYORu (ORCPT ); Thu, 25 Jan 2018 09:17:50 -0500 Subject: Re: [PATCH net-next] ptr_ring: fix integer overflow To: "Michael S. Tsirkin" Cc: linux-kernel@vger.kernel.org, netdev@vger.kernel.org, John Fastabend References: <1516865502-20835-1-git-send-email-jasowang@redhat.com> <20180125154255-mutt-send-email-mst@kernel.org> From: Jason Wang Message-ID: <81ecef6f-5076-873c-2f0d-e08e0a35dcf5@redhat.com> Date: Thu, 25 Jan 2018 22:17:38 +0800 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.5.0 MIME-Version: 1.0 In-Reply-To: <20180125154255-mutt-send-email-mst@kernel.org> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 2018年01月25日 21:45, Michael S. Tsirkin wrote: > On Thu, Jan 25, 2018 at 03:31:42PM +0800, Jason Wang wrote: >> We try to allocate one more entry for lockless peeking. The adding >> operation may overflow which causes zero to be passed to kmalloc(). >> In this case, it returns ZERO_SIZE_PTR without any notice by ptr >> ring. Try to do producing or consuming on such ring will lead NULL >> dereference. Fix this detect and fail early. >> >> Fixes: bcecb4bbf88a ("net: ptr_ring: otherwise safe empty checks can overrun array bounds") >> Reported-by:syzbot+87678bcf753b44c39b67@syzkaller.appspotmail.com >> Cc: John Fastabend >> Signed-off-by: Jason Wang > Ugh that's just way too ugly. > I'll work on dropping the extra + 1 - but calling this > function with -1 size is the real source of the bug. > Do you know how come we do that? > It looks e.g try to change tx_queue_len to UINT_MAX. And we probably can't prevent user form trying to do this? Thanks