linux-toradex.git/include/linux/ptr_ring.h, branch v5.1-rc1

ptr_ring: remove duplicated include from ptr_ring.h

2019-02-17T23:53:01+00:00

Remove duplicated include.

Signed-off-by: YueHaibing 
Signed-off-by: David S. Miller

ptr_ring: wrap back ->producer in __ptr_ring_swap_queue()

2019-01-01T19:58:33+00:00

__ptr_ring_swap_queue() tries to move pointers from the old
ring to the new one, but it forgets to check if ->producer
is beyond the new size at the end of the operation. This leads
to an out-of-bound access in __ptr_ring_produce() as reported
by syzbot.

Reported-by: syzbot+8993c0fa96d57c399735@syzkaller.appspotmail.com
Fixes: 5d49de532002 ("ptr_ring: resize support")
Cc: "Michael S. Tsirkin" 
Cc: John Fastabend 
Cc: Jason Wang 
Signed-off-by: Cong Wang 
Acked-by: Michael S. Tsirkin 
Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2018-02-19T23:46:11+00:00

ptr_ring: Remove now-redundant smp_read_barrier_depends()

2018-02-19T16:11:16+00:00

Because READ_ONCE() now implies smp_read_barrier_depends(), the
smp_read_barrier_depends() in __ptr_ring_consume() is redundant;
this commit removes it and updates the comments.

Signed-off-by: Andrea Parri 
Cc: "David S. Miller" 
Cc: "Michael S. Tsirkin" 
Cc: Jason Wang 
Cc: John Fastabend 
Cc: Eric Dumazet 
Cc: 
Cc: 
Signed-off-by: David S. Miller

ptr_ring: prevent integer overflow when calculating size

2018-02-12T03:33:22+00:00

Switch to use dividing to prevent integer overflow when size is too
big to calculate allocation size properly.

Reported-by: Eric Biggers 
Fixes: 6e6e41c31122 ("ptr_ring: fail early if queue occupies more than KMALLOC_MAX_SIZE")
Signed-off-by: Jason Wang 
Acked-by: Michael S. Tsirkin 
Signed-off-by: David S. Miller

ptr_ring: try vmalloc() when kmalloc() fails

2018-02-09T19:28:57+00:00

This patch switch to use kvmalloc_array() for using a vmalloc()
fallback to help in case kmalloc() fails.

Reported-by: syzbot+e4d4f9ddd4295539735d@syzkaller.appspotmail.com
Fixes: 2e0ab8ca83c12 ("ptr_ring: array based FIFO for pointers")
Signed-off-by: Jason Wang 
Acked-by: Michael S. Tsirkin 
Signed-off-by: David S. Miller

ptr_ring: fail early if queue occupies more than KMALLOC_MAX_SIZE

2018-02-09T19:28:57+00:00

To avoid slab to warn about exceeded size, fail early if queue
occupies more than KMALLOC_MAX_SIZE.

Reported-by: syzbot+e4d4f9ddd4295539735d@syzkaller.appspotmail.com
Fixes: 2e0ab8ca83c12 ("ptr_ring: array based FIFO for pointers")
Signed-off-by: Jason Wang 
Acked-by: Michael S. Tsirkin 
Signed-off-by: David S. Miller

ptr_ring: prevent queue load/store tearing

2018-01-29T17:02:54+00:00

In theory compiler could tear queue loads or stores in two. It does not
seem to be happening in practice but it seems easier to convert the
cases where this would be a problem to READ/WRITE_ONCE than worry about
it.

Signed-off-by: Michael S. Tsirkin 
Signed-off-by: David S. Miller

Revert "net: ptr_ring: otherwise safe empty checks can overrun array bounds"

2018-01-29T17:02:54+00:00

This reverts commit bcecb4bbf88aa03171c30652bca761cf27755a6b.

If we try to allocate an extra entry as the above commit did, and when
the requested size is UINT_MAX, addition overflows causing zero size to
be passed to kmalloc().

kmalloc then returns ZERO_SIZE_PTR with a subsequent crash.

Reported-by: syzbot+87678bcf753b44c39b67@syzkaller.appspotmail.com
Cc: John Fastabend 
Signed-off-by: Michael S. Tsirkin 
Acked-by: John Fastabend 
Signed-off-by: David S. Miller

ptr_ring: disallow lockless __ptr_ring_full

2018-01-29T17:02:54+00:00

Similar to bcecb4bbf88a ("net: ptr_ring: otherwise safe empty checks can
overrun array bounds") a lockless use of __ptr_ring_full might
cause an out of bounds access.

We can fix this, but it's easier to just disallow lockless
__ptr_ring_full for now.

Signed-off-by: Michael S. Tsirkin 
Signed-off-by: David S. Miller