All of lore.kernel.org
 help / color / mirror / Atom feed
From: Grant Grundler <grundler@chromium.org>
To: Igor Russkikh <irusskikh@marvell.com>
Cc: Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
	netdev <netdev@vger.kernel.org>,
	"David S . Miller" <davem@davemloft.net>,
	LKML <linux-kernel@vger.kernel.org>,
	Aashay Shringarpure <aashay@google.com>,
	Yi Chou <yich@google.com>,
	Shervin Oloumi <enlightened@google.com>,
	Grant Grundler <grundler@chromium.org>
Subject: [PATCH 4/5] net: atlantic: add check for MAX_SKB_FRAGS
Date: Mon, 18 Apr 2022 16:17:45 -0700	[thread overview]
Message-ID: <20220418231746.2464800-5-grundler@chromium.org> (raw)
In-Reply-To: <20220418231746.2464800-1-grundler@chromium.org>

Enforce that the CPU can not get stuck in an infinite loop.

Reported-by: Aashay Shringarpure <aashay@google.com>
Reported-by: Yi Chou <yich@google.com>
Reported-by: Shervin Oloumi <enlightened@google.com>
Signed-off-by: Grant Grundler <grundler@chromium.org>
---
 drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
index bc1952131799..8201ce7adb77 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
@@ -363,6 +363,7 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
 			continue;
 
 		if (!buff->is_eop) {
+			unsigned int frag_cnt = 0U;
 			buff_ = buff;
 			do {
 				bool is_rsc_completed = true;
@@ -371,6 +372,8 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
 					err = -EIO;
 					goto err_exit;
 				}
+
+				frag_cnt++;
 				next_ = buff_->next,
 				buff_ = &self->buff_ring[next_];
 				is_rsc_completed =
@@ -378,7 +381,8 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
 							    next_,
 							    self->hw_head);
 
-				if (unlikely(!is_rsc_completed)) {
+				if (unlikely(!is_rsc_completed) ||
+				    frag_cnt > MAX_SKB_FRAGS) {
 					err = 0;
 					goto err_exit;
 				}
-- 
2.36.0.rc0.470.gd361397f0d-goog


  parent reply	other threads:[~2022-04-18 23:18 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-04-18 23:17 [PATCH 0/5] net: atlantic: more fuzzing fixes Grant Grundler
2022-04-18 23:17 ` [PATCH 1/5] net: atlantic: limit buff_ring index value Grant Grundler
2022-04-18 23:17 ` [PATCH 2/5] net: atlantic: fix "frag[0] not initialized" Grant Grundler
2022-04-18 23:17 ` [PATCH 3/5] net: atlantic: reduce scope of is_rsc_complete Grant Grundler
2022-04-18 23:17 ` Grant Grundler [this message]
2022-04-18 23:17 ` [PATCH 5/5] net: atlantic: verify hw_head_ is reasonable Grant Grundler
2022-04-21 19:53 ` [PATCH 0/5] net: atlantic: more fuzzing fixes Grant Grundler
2022-04-26 16:00   ` [EXT] " Igor Russkikh
2022-04-26 17:20     ` Grant Grundler
2022-05-03 11:14       ` Dmitrii Bezrukov
2022-05-03 18:07         ` Grant Grundler
2022-05-04 14:39           ` Dmitrii Bezrukov
2022-05-04 20:11             ` Grant Grundler
2022-05-05  7:11               ` Igor Russkikh
2022-05-05 20:57                 ` Grant Grundler

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220418231746.2464800-5-grundler@chromium.org \
    --to=grundler@chromium.org \
    --cc=aashay@google.com \
    --cc=davem@davemloft.net \
    --cc=enlightened@google.com \
    --cc=irusskikh@marvell.com \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=yich@google.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.