From: Haiyue Wang <haiyue.wang@intel.com>
To: netdev@vger.kernel.org
Cc: Haiyue Wang <haiyue.wang@intel.com>,
Catherine Sullivan <csully@google.com>,
Sagi Shahar <sagis@google.com>, Jon Olson <jonolson@google.com>,
"David S. Miller" <davem@davemloft.net>,
Jakub Kicinski <kuba@kernel.org>,
David Awogbemila <awogbemila@google.com>,
Yangchun Fu <yangchun@google.com>,
Willem de Bruijn <willemb@google.com>,
Bailey Forrest <bcf@google.com>, Kuo Zhao <kuozhao@google.com>,
linux-kernel@vger.kernel.org (open list)
Subject: [PATCH v1] gve: fix the wrong AdminQ buffer overflow check
Date: Wed, 14 Jul 2021 15:34:59 +0800 [thread overview]
Message-ID: <20210714073501.133736-1-haiyue.wang@intel.com> (raw)
The 'tail' pointer is also free-running count, so it needs to be masked
as 'adminq_prod_cnt' does, to become an index value of AdminQ buffer.
Fixes: 5cdad90de62c ("gve: Batch AQ commands for creating and destroying queues.")
Signed-off-by: Haiyue Wang <haiyue.wang@intel.com>
---
drivers/net/ethernet/google/gve/gve_adminq.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/google/gve/gve_adminq.c b/drivers/net/ethernet/google/gve/gve_adminq.c
index 5bb56b454541..f089d33dd48e 100644
--- a/drivers/net/ethernet/google/gve/gve_adminq.c
+++ b/drivers/net/ethernet/google/gve/gve_adminq.c
@@ -322,7 +322,8 @@ static int gve_adminq_issue_cmd(struct gve_priv *priv,
tail = ioread32be(&priv->reg_bar0->adminq_event_counter);
// Check if next command will overflow the buffer.
- if (((priv->adminq_prod_cnt + 1) & priv->adminq_mask) == tail) {
+ if (((priv->adminq_prod_cnt + 1) & priv->adminq_mask) ==
+ (tail & priv->adminq_mask)) {
int err;
// Flush existing commands to make room.
@@ -332,7 +333,8 @@ static int gve_adminq_issue_cmd(struct gve_priv *priv,
// Retry.
tail = ioread32be(&priv->reg_bar0->adminq_event_counter);
- if (((priv->adminq_prod_cnt + 1) & priv->adminq_mask) == tail) {
+ if (((priv->adminq_prod_cnt + 1) & priv->adminq_mask) ==
+ (tail & priv->adminq_mask)) {
// This should never happen. We just flushed the
// command queue so there should be enough space.
return -ENOMEM;
--
2.32.0
next reply other threads:[~2021-07-14 7:58 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-14 7:34 Haiyue Wang [this message]
2021-07-14 22:45 ` [PATCH v1] gve: fix the wrong AdminQ buffer overflow check Catherine Sullivan
2021-07-16 17:50 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210714073501.133736-1-haiyue.wang@intel.com \
--to=haiyue.wang@intel.com \
--cc=awogbemila@google.com \
--cc=bcf@google.com \
--cc=csully@google.com \
--cc=davem@davemloft.net \
--cc=jonolson@google.com \
--cc=kuba@kernel.org \
--cc=kuozhao@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=sagis@google.com \
--cc=willemb@google.com \
--cc=yangchun@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.