linux-kernel - Re: [Xen-devel] [PATCH] drivers: net: xen-netfront: fix array initialization bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <534C1A0E.1080307@citrix.com>
Date:	Mon, 14 Apr 2014 18:25:34 +0100
From:	David Vrabel <david.vrabel@...rix.com>
To:	David Miller <davem@...emloft.net>
CC:	<v.maffione@...il.com>, <netdev@...r.kernel.org>,
	<linux-kernel@...r.kernel.org>, <xen-devel@...ts.xenproject.org>,
	<boris.ostrovsky@...cle.com>
Subject: Re: [Xen-devel] [PATCH] drivers: net: xen-netfront: fix array initialization
 bug

On 14/04/14 17:51, David Miller wrote:
> From: David Vrabel <david.vrabel@...rix.com>
> Date: Mon, 14 Apr 2014 10:42:20 +0100
> 
>> On 12/04/14 21:51, David Miller wrote:
>>> From: Vincenzo Maffione <v.maffione@...il.com>
>>> Date: Sat, 12 Apr 2014 11:55:40 +0200
>>>
>>>> This patch fixes the initialization of an array used in the TX
>>>> datapath that was mistakenly initialized together with the
>>>> RX datapath arrays. An out of range array access could happen
>>>> when RX and TX rings had different sizes.
>>>>
>>>> Signed-off-by: Vincenzo Maffione <v.maffione@...il.com>
>>>
>>> Good catch, applied, thanks.
>>
>> Thanks.  You can queue this for net-next since the Tx and Rx rings are
>> the same constant size.
> 
> I was able to determine when I reviewed this patch that the size in bytes
> of the rings are the same (PAGE_SIZE), but I couldn't ascertain whether
> the individual ring entries in the TX ring and RX ring are the same size.
> 
> Are they?

Yes.  It's not at all obvious, but each ends up with 256 entries.

Tx entries are 12 bytes and Rx entries are 8 bytes.  The ring macros
reserve some space in the shared page for the producer/consumer indexes
/and/ round down the number to the next power of two.

David

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/