netdev - Re: [Patch net] ptr_ring: wrap back ->producer in __ptr_ring_swap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 1 Jan 2019 10:58:32 -0800
From:   Cong Wang <xiyou.wangcong@...il.com>
To:     "Michael S. Tsirkin" <mst@...hat.com>
Cc:     Linux Kernel Network Developers <netdev@...r.kernel.org>,
        John Fastabend <john.fastabend@...il.com>,
        Jason Wang <jasowang@...hat.com>
Subject: Re: [Patch net] ptr_ring: wrap back ->producer in __ptr_ring_swap_queue()

On Sun, Dec 30, 2018 at 4:52 PM Michael S. Tsirkin <mst@...hat.com> wrote:
> So when we allocated one extra entry it was fine, thus maybe we should rather list:
>
> Fixes: 9fb582b67072 ("Revert "net: ptr_ring: otherwise safe empty checks can overrun array bounds"")
>
>

Good point, I totally forgot we once allocated one extra entry.

However, prior to commit bcecb4bbf88a which introduced the
extra one entry, this bug exists too, IIUC. Commit bcecb4bbf88a
is merged 18 months after commit 5d49de532002 which is
supposed to the one introduced this bug.

On the other hand, it does not harm even if we backport this
to a kernel release with commit bcecb4bbf88a.

Thanks.