Zekun Shen
5f50153288
atlantic: Fix buff_ring OOB in aq_ring_rx_clean
The function obtain the next buffer without boundary check.
We should return with I/O error code.
The bug is found by fuzzing and the crash report is attached.
It is an OOB bug although reported as use-after-free.
[ 4.804724] BUG: KASAN: use-after-free in aq_ring_rx_clean+0x1e88/0x2730 [atlantic]
[ 4.805661] Read of size 4 at addr ffff888034fe93a8 by task ksoftirqd/0/9
[ 4.806505]
[ 4.806703] CPU: 0 PID: 9 Comm: ksoftirqd/0 Tainted: G W 5.6.0 #34
[ 4.809030] Call Trace:
[ 4.809343] dump_stack+0x76/0xa0
[ 4.809755] print_address_description.constprop.0+0x16/0x200
[ 4.810455] ? aq_ring_rx_clean+0x1e88/0x2730 [atlantic]
[ 4.811234] ? aq_ring_rx_clean+0x1e88/0x2730 [atlantic]
[ 4.813183] __kasan_report.cold+0x37/0x7c
[ 4.813715] ? aq_ring_rx_clean+0x1e88/0x2730 [atlantic]
[ 4.814393] kasan_report+0xe/0x20
[ 4.814837] aq_ring_rx_clean+0x1e88/0x2730 [atlantic]
[ 4.815499] ? hw_atl_b0_hw_ring_rx_receive+0x9a5/0xb90 [atlantic]
[ 4.816290] aq_vec_poll+0x179/0x5d0 [atlantic]
[ 4.816870] ? _GLOBAL__sub_I_65535_1_aq_pci_func_init+0x20/0x20 [atlantic]
[ 4.817746] ? __next_timer_interrupt+0xba/0xf0
[ 4.818322] net_rx_action+0x363/0xbd0
[ 4.818803] ? call_timer_fn+0x240/0x240
[ 4.819302] ? __switch_to_asm+0x40/0x70
[ 4.819809] ? napi_busy_loop+0x520/0x520
[ 4.820324] __do_softirq+0x18c/0x634
[ 4.820797] ? takeover_tasklets+0x5f0/0x5f0
[ 4.821343] run_ksoftirqd+0x15/0x20
[ 4.821804] smpboot_thread_fn+0x2f1/0x6b0
[ 4.822331] ? smpboot_unregister_percpu_thread+0x160/0x160
[ 4.823041] ? __kthread_parkme+0x80/0x100
[ 4.823571] ? smpboot_unregister_percpu_thread+0x160/0x160
[ 4.824301] kthread+0x2b5/0x3b0
[ 4.824723] ? kthread_create_on_node+0xd0/0xd0
[ 4.825304] ret_from_fork+0x35/0x40
Signed-off-by: Zekun Shen <bruceshenzk@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-12-27 14:49:53 +00:00
..
2021-12-21 16:54:19 -08:00
2021-12-09 09:01:43 +01:00
2021-12-16 10:57:21 +00:00
2021-12-27 14:49:53 +00:00
2021-12-22 10:22:13 +00:00
2021-12-18 12:32:48 +00:00
2021-11-02 10:56:49 -07:00
2021-11-23 12:26:40 +00:00
2021-11-25 07:44:42 -08:00
2021-12-15 17:49:13 -08:00
2021-12-24 14:52:10 -08:00
2021-11-04 09:09:37 -07:00
2021-11-23 11:38:13 +00:00
2021-12-23 09:56:06 -08:00
2021-12-08 17:56:39 -08:00
2021-11-29 19:50:50 -08:00
2021-12-16 15:02:14 -08:00
2021-12-09 08:10:35 -08:00
2021-12-16 08:43:12 +01:00
2021-11-16 19:14:12 -08:00
2021-10-29 13:41:28 +01:00
2021-10-29 14:01:11 +01:00
2021-11-27 14:34:41 -08:00
2021-11-01 13:36:08 +00:00
2021-11-09 11:45:54 +00:00
2021-12-17 19:21:58 -08:00
2021-12-23 09:44:06 -08:00
2021-12-16 11:07:19 +00:00
2021-12-08 17:02:35 -08:00
2021-12-16 08:24:08 +01:00