| Message ID | YHBHfCY/yv3EnM9z@mwanda (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 626b598aa8becc95ad1c56e721c90ddfc6a8c409 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net-next] net: enetc: fix array underflow in error handling code | expand |
| Context | Check | Description |
|---|---|---|
| netdev/cover_letter | success | Link |
| netdev/fixes_present | success | Link |
| netdev/patch_count | success | Link |
| netdev/tree_selection | success | Clearly marked for net-next |
| netdev/subject_prefix | success | Link |
| netdev/cc_maintainers | success | CCed 5 of 5 maintainers |
| netdev/source_inline | success | Was 0 now: 0 |
| netdev/verify_signedoff | success | Link |
| netdev/module_param | success | Was 0 now: 0 |
| netdev/build_32bit | success | Errors and warnings before: 0 this patch: 0 |
| netdev/kdoc | success | Errors and warnings before: 0 this patch: 0 |
| netdev/verify_fixes | success | Link |
| netdev/checkpatch | success | total: 0 errors, 0 warnings, 0 checks, 8 lines checked |
| netdev/build_allmodconfig_warn | success | Errors and warnings before: 0 this patch: 0 |
| netdev/header_inline | success | Link |
>-----Original Message----- >From: Dan Carpenter <dan.carpenter@oracle.com> [...] >Subject: [PATCH net-next] net: enetc: fix array underflow in error handling >code > >This loop will try to unmap enetc_unmap_tx_buff[-1] and crash. > >Fixes: 9d2b68cc108d ("net: enetc: add support for XDP_REDIRECT") >Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Claudiu Manoil <claudiu.manoil@nxp.com>
On Fri, Apr 09, 2021 at 03:24:28PM +0300, Dan Carpenter wrote: > This loop will try to unmap enetc_unmap_tx_buff[-1] and crash. > > Fixes: 9d2b68cc108d ("net: enetc: add support for XDP_REDIRECT") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > --- > drivers/net/ethernet/freescale/enetc/enetc.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c > index 57049ae97201..d86395775ed0 100644 > --- a/drivers/net/ethernet/freescale/enetc/enetc.c > +++ b/drivers/net/ethernet/freescale/enetc/enetc.c > @@ -895,7 +895,7 @@ static int enetc_xdp_frame_to_xdp_tx_swbd(struct enetc_bdr *tx_ring, > dma = dma_map_single(tx_ring->dev, data, len, DMA_TO_DEVICE); > if (unlikely(dma_mapping_error(tx_ring->dev, dma))) { > /* Undo the DMA mapping for all fragments */ > - while (n-- >= 0) > + while (--n >= 0) > enetc_unmap_tx_buff(tx_ring, &xdp_tx_arr[n]); > > netdev_err(tx_ring->ndev, "DMA map error\n"); > -- > 2.30.2 > I have no idea what went wrong. I distinctly remember "testing" this by writing up a small program: #include <stdio.h> int main(void) { int n = 5; while (n-- >= 0) printf("%d\n", n); return 0; } I find myself doing that most of the time when there is a need for an unrolling loop. I do see that this goes down to -1, I wonder how I missed it. Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Hello: This patch was applied to netdev/net-next.git (refs/heads/master): On Fri, 9 Apr 2021 15:24:28 +0300 you wrote: > This loop will try to unmap enetc_unmap_tx_buff[-1] and crash. > > Fixes: 9d2b68cc108d ("net: enetc: add support for XDP_REDIRECT") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > --- > drivers/net/ethernet/freescale/enetc/enetc.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) Here is the summary with links: - [net-next] net: enetc: fix array underflow in error handling code https://git.kernel.org/netdev/net-next/c/626b598aa8be You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c index 57049ae97201..d86395775ed0 100644 --- a/drivers/net/ethernet/freescale/enetc/enetc.c +++ b/drivers/net/ethernet/freescale/enetc/enetc.c @@ -895,7 +895,7 @@ static int enetc_xdp_frame_to_xdp_tx_swbd(struct enetc_bdr *tx_ring, dma = dma_map_single(tx_ring->dev, data, len, DMA_TO_DEVICE); if (unlikely(dma_mapping_error(tx_ring->dev, dma))) { /* Undo the DMA mapping for all fragments */ - while (n-- >= 0) + while (--n >= 0) enetc_unmap_tx_buff(tx_ring, &xdp_tx_arr[n]); netdev_err(tx_ring->ndev, "DMA map error\n");
This loop will try to unmap enetc_unmap_tx_buff[-1] and crash. Fixes: 9d2b68cc108d ("net: enetc: add support for XDP_REDIRECT") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- drivers/net/ethernet/freescale/enetc/enetc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)