Revert "net: ptr_ring: otherwise safe empty checks can overrun array bounds"
authorMichael S. Tsirkin <mst@redhat.com>
Thu, 25 Jan 2018 23:36:35 +0000 (01:36 +0200)
committerDavid S. Miller <davem@davemloft.net>
Mon, 29 Jan 2018 17:02:54 +0000 (12:02 -0500)
commit9fb582b67072bea6cbfe1aefc2be13c62c7681bf
treec2be3e6f9bc8cde4512dbb7871fcc5801c9f45c2
parent84328342a70a44379dd73011a44c5f5e00481a42
Revert "net: ptr_ring: otherwise safe empty checks can overrun array bounds"

This reverts commit bcecb4bbf88aa03171c30652bca761cf27755a6b.

If we try to allocate an extra entry as the above commit did, and when
the requested size is UINT_MAX, addition overflows causing zero size to
be passed to kmalloc().

kmalloc then returns ZERO_SIZE_PTR with a subsequent crash.

Reported-by: syzbot+87678bcf753b44c39b67@syzkaller.appspotmail.com
Cc: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
include/linux/ptr_ring.h