All of lore.kernel.org
 help / color / mirror / Atom feed
From: Grant Grundler <grundler@chromium.org>
To: Igor Russkikh <irusskikh@marvell.com>
Cc: Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
	netdev <netdev@vger.kernel.org>,
	"David S . Miller" <davem@davemloft.net>,
	LKML <linux-kernel@vger.kernel.org>,
	Aashay Shringarpure <aashay@google.com>,
	Yi Chou <yich@google.com>,
	Shervin Oloumi <enlightened@google.com>,
	Grant Grundler <grundler@chromium.org>
Subject: [PATCH 2/5] net: atlantic:  fix "frag[0] not initialized"
Date: Mon, 18 Apr 2022 16:17:43 -0700	[thread overview]
Message-ID: <20220418231746.2464800-3-grundler@chromium.org> (raw)
In-Reply-To: <20220418231746.2464800-1-grundler@chromium.org>

In aq_ring_rx_clean(), if buff->is_eop is not set AND
buff->len < AQ_CFG_RX_HDR_SIZE, then hdr_len remains equal to
buff->len and skb_add_rx_frag(xxx, *0*, ...) is not called.

The loop following this code starts calling skb_add_rx_frag() starting
with i=1 and thus frag[0] is never initialized. Since i is initialized
to zero at the top of the primary loop, we can just reference and
post-increment i instead of hardcoding the 0 when calling
skb_add_rx_frag() the first time.

Reported-by: Aashay Shringarpure <aashay@google.com>
Reported-by: Yi Chou <yich@google.com>
Reported-by: Shervin Oloumi <enlightened@google.com>
Signed-off-by: Grant Grundler <grundler@chromium.org>
---
 drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
index 77e76c9efd32..440423b0e8ea 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
@@ -446,7 +446,7 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
 		       ALIGN(hdr_len, sizeof(long)));
 
 		if (buff->len - hdr_len > 0) {
-			skb_add_rx_frag(skb, 0, buff->rxdata.page,
+			skb_add_rx_frag(skb, i++, buff->rxdata.page,
 					buff->rxdata.pg_off + hdr_len,
 					buff->len - hdr_len,
 					AQ_CFG_RX_FRAME_MAX);
@@ -455,7 +455,6 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
 
 		if (!buff->is_eop) {
 			buff_ = buff;
-			i = 1U;
 			do {
 				next_ = buff_->next;
 				buff_ = &self->buff_ring[next_];
-- 
2.36.0.rc0.470.gd361397f0d-goog


  parent reply	other threads:[~2022-04-18 23:18 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-04-18 23:17 [PATCH 0/5] net: atlantic: more fuzzing fixes Grant Grundler
2022-04-18 23:17 ` [PATCH 1/5] net: atlantic: limit buff_ring index value Grant Grundler
2022-04-18 23:17 ` Grant Grundler [this message]
2022-04-18 23:17 ` [PATCH 3/5] net: atlantic: reduce scope of is_rsc_complete Grant Grundler
2022-04-18 23:17 ` [PATCH 4/5] net: atlantic: add check for MAX_SKB_FRAGS Grant Grundler
2022-04-18 23:17 ` [PATCH 5/5] net: atlantic: verify hw_head_ is reasonable Grant Grundler
2022-04-21 19:53 ` [PATCH 0/5] net: atlantic: more fuzzing fixes Grant Grundler
2022-04-26 16:00   ` [EXT] " Igor Russkikh
2022-04-26 17:20     ` Grant Grundler
2022-05-03 11:14       ` Dmitrii Bezrukov
2022-05-03 18:07         ` Grant Grundler
2022-05-04 14:39           ` Dmitrii Bezrukov
2022-05-04 20:11             ` Grant Grundler
2022-05-05  7:11               ` Igor Russkikh
2022-05-05 20:57                 ` Grant Grundler

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220418231746.2464800-3-grundler@chromium.org \
    --to=grundler@chromium.org \
    --cc=aashay@google.com \
    --cc=davem@davemloft.net \
    --cc=enlightened@google.com \
    --cc=irusskikh@marvell.com \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=yich@google.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.