Zekun Shen
5f50153288
atlantic: Fix buff_ring OOB in aq_ring_rx_clean ...
The function obtain the next buffer without boundary check.
We should return with I/O error code.
The bug is found by fuzzing and the crash report is attached.
It is an OOB bug although reported as use-after-free.
[ 4.804724] BUG: KASAN: use-after-free in aq_ring_rx_clean+0x1e88/0x2730 [atlantic]
[ 4.805661] Read of size 4 at addr ffff888034fe93a8 by task ksoftirqd/0/9
[ 4.806505]
[ 4.806703] CPU: 0 PID: 9 Comm: ksoftirqd/0 Tainted: G W 5.6.0 #34
[ 4.809030] Call Trace:
[ 4.809343] dump_stack+0x76/0xa0
[ 4.809755] print_address_description.constprop.0+0x16/0x200
[ 4.810455] ? aq_ring_rx_clean+0x1e88/0x2730 [atlantic]
[ 4.811234] ? aq_ring_rx_clean+0x1e88/0x2730 [atlantic]
[ 4.813183] __kasan_report.cold+0x37/0x7c
[ 4.813715] ? aq_ring_rx_clean+0x1e88/0x2730 [atlantic]
[ 4.814393] kasan_report+0xe/0x20
[ 4.814837] aq_ring_rx_clean+0x1e88/0x2730 [atlantic]
[ 4.815499] ? hw_atl_b0_hw_ring_rx_receive+0x9a5/0xb90 [atlantic]
[ 4.816290] aq_vec_poll+0x179/0x5d0 [atlantic]
[ 4.816870] ? _GLOBAL__sub_I_65535_1_aq_pci_func_init+0x20/0x20 [atlantic]
[ 4.817746] ? __next_timer_interrupt+0xba/0xf0
[ 4.818322] net_rx_action+0x363/0xbd0
[ 4.818803] ? call_timer_fn+0x240/0x240
[ 4.819302] ? __switch_to_asm+0x40/0x70
[ 4.819809] ? napi_busy_loop+0x520/0x520
[ 4.820324] __do_softirq+0x18c/0x634
[ 4.820797] ? takeover_tasklets+0x5f0/0x5f0
[ 4.821343] run_ksoftirqd+0x15/0x20
[ 4.821804] smpboot_thread_fn+0x2f1/0x6b0
[ 4.822331] ? smpboot_unregister_percpu_thread+0x160/0x160
[ 4.823041] ? __kthread_parkme+0x80/0x100
[ 4.823571] ? smpboot_unregister_percpu_thread+0x160/0x160
[ 4.824301] kthread+0x2b5/0x3b0
[ 4.824723] ? kthread_create_on_node+0xd0/0xd0
[ 4.825304] ret_from_fork+0x35/0x40
Signed-off-by: Zekun Shen <bruceshenzk@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-12-27 14:49:53 +00:00
2021-11-26 19:45:31 +01:00
2021-10-19 10:30:53 +01:00
2021-12-09 10:49:56 -08:00
2021-12-17 09:32:13 +09:00
2021-10-22 00:13:16 +02:00
2021-12-17 18:36:08 +01:00
2021-11-06 14:36:12 -07:00
2021-12-16 08:24:08 +01:00
2021-11-04 09:09:37 -07:00
2021-12-17 16:04:54 +01:00
2021-11-01 10:09:14 -07:00
2021-12-22 10:11:17 -08:00
2021-12-07 19:20:35 -08:00
2021-12-10 17:47:00 +01:00
2021-10-30 10:54:47 +02:00
2021-10-21 13:02:47 +02:00
2021-12-01 20:02:11 +01:00
2021-11-03 17:00:52 -07:00
2021-12-17 13:11:54 +11:00
2021-11-08 11:49:48 -08:00
2021-11-10 14:06:51 +01:00
2021-12-13 13:18:48 +05:30
2021-12-01 15:30:10 +05:30
2021-11-01 15:02:49 -07:00
2021-10-27 14:13:39 +09:00
2021-11-05 08:42:02 -07:00
2021-12-13 15:17:37 +01:00
2021-10-22 09:54:33 +10:30
2021-12-21 16:22:58 +01:00
2021-12-23 11:21:44 +10:00
2021-12-20 11:26:14 +01:00
2021-11-04 13:56:55 -07:00
2021-11-28 21:22:35 +00:00
2021-11-30 06:44:18 -08:00
2021-10-27 11:46:01 -06:00
2021-12-10 22:27:30 +01:00
2021-12-04 15:37:02 +00:00
2021-12-14 20:13:29 -04:00
2021-11-23 13:41:29 -06:00
2021-11-26 22:54:47 +01:00
2021-12-10 13:23:13 +00:00
2021-10-19 13:09:28 +01:00
2021-11-06 14:08:17 -07:00
2021-10-29 23:03:09 -05:00
2021-12-17 11:46:07 -08:00
2021-11-22 14:58:57 -08:00
2021-11-25 14:46:00 +01:00
2021-10-19 13:04:42 +02:00
2021-11-06 14:36:12 -07:00
2021-11-10 11:36:43 -08:00
2021-12-03 14:32:00 +01:00
2021-12-21 13:03:51 +01:00
2021-10-26 19:12:01 +02:00
2021-12-10 11:52:34 -07:00
2021-10-21 20:02:42 +01:00
2021-12-27 14:49:53 +00:00
2021-11-26 11:14:31 -08:00
2021-11-10 10:56:02 -08:00
2021-12-08 16:36:58 +01:00
2021-10-18 09:29:27 +02:00
2021-12-03 11:30:22 -06:00
2021-12-19 12:28:46 -08:00
2021-11-02 06:20:58 -07:00
2021-11-02 15:58:39 -07:00
2021-11-23 10:42:13 +05:30
2021-11-16 02:19:15 +01:00
2021-12-07 10:10:20 -08:00
2021-11-02 16:48:47 +01:00
2021-12-03 17:51:59 +01:00
2021-11-18 12:12:55 +00:00
2021-11-05 11:57:13 +01:00
2021-11-06 13:30:33 -07:00
2021-11-08 12:07:52 -08:00
2021-10-15 09:49:55 -05:00
2021-11-17 17:22:27 +01:00
2021-11-10 09:07:26 -08:00
2021-11-12 11:44:31 -08:00
2021-11-16 12:29:19 +01:00
2021-12-17 13:55:03 -08:00
2021-12-16 15:02:26 +01:00
2021-10-20 20:54:59 +05:30
2021-12-20 10:23:19 -08:00
2021-11-17 14:08:57 +01:00
2021-11-18 23:07:02 -05:00
2021-12-23 09:22:34 -08:00
2021-12-08 15:29:22 +01:00
2021-10-25 13:17:29 +02:00
2021-12-20 07:42:21 -08:00
2021-10-28 11:22:23 +00:00
2021-12-17 16:29:11 +01:00
2021-12-08 15:41:50 -05:00
2021-11-30 11:41:49 -07:00
2021-12-08 14:53:15 -05:00
2021-12-05 09:13:20 -08:00
2021-12-08 15:04:06 -05:00
2021-11-10 09:41:22 -08:00
2021-12-16 08:24:08 +01:00
2021-12-08 14:53:15 -05:00
5f50153288