From: Cong Wang
Date: Sun, 30 Dec 2018 12:43:42 -0800
> __ptr_ring_swap_queue() tries to move pointers from the old
> ring to the new one, but it forgets to check if ->producer
> is beyond the new size at the end of the operation. This leads
> to an out-of-bound access in __ptr_ring_produce() as
On Sun, Dec 30, 2018 at 4:52 PM Michael S. Tsirkin wrote:
> So when we allocated one extra entry it was fine, thus maybe we should rather
> list:
>
> Fixes: 9fb582b67072 ("Revert "net: ptr_ring: otherwise safe empty checks can
> overrun array bounds"")
>
>
Good point, I totally forgot we once a
On Sun, Dec 30, 2018 at 12:43:42PM -0800, Cong Wang wrote:
> __ptr_ring_swap_queue() tries to move pointers from the old
> ring to the new one, but it forgets to check if ->producer
> is beyond the new size at the end of the operation. This leads
> to an out-of-bound access in __ptr_ring_produce()
__ptr_ring_swap_queue() tries to move pointers from the old
ring to the new one, but it forgets to check if ->producer
is beyond the new size at the end of the operation. This leads
to an out-of-bound access in __ptr_ring_produce() as reported
by syzbot.
Reported-by: syzbot+8993c0fa96d57c399...@sy
