* [PATCH net-next] net: enetc: fix array underflow in error handling code
@ 2021-04-09 12:24 Dan Carpenter
2021-04-09 12:46 ` Claudiu Manoil
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Dan Carpenter @ 2021-04-09 12:24 UTC (permalink / raw)
To: Claudiu Manoil
Cc: David S. Miller, Jakub Kicinski, Vladimir Oltean, netdev,
kernel-janitors
This loop will try to unmap enetc_unmap_tx_buff[-1] and crash.
Fixes: 9d2b68cc108d ("net: enetc: add support for XDP_REDIRECT")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/net/ethernet/freescale/enetc/enetc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c
index 57049ae97201..d86395775ed0 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc.c
@@ -895,7 +895,7 @@ static int enetc_xdp_frame_to_xdp_tx_swbd(struct enetc_bdr *tx_ring,
dma = dma_map_single(tx_ring->dev, data, len, DMA_TO_DEVICE);
if (unlikely(dma_mapping_error(tx_ring->dev, dma))) {
/* Undo the DMA mapping for all fragments */
- while (n-- >= 0)
+ while (--n >= 0)
enetc_unmap_tx_buff(tx_ring, &xdp_tx_arr[n]);
netdev_err(tx_ring->ndev, "DMA map error\n");
--
2.30.2
^ permalink raw reply related [flat|nested] 4+ messages in thread
* RE: [PATCH net-next] net: enetc: fix array underflow in error handling code
2021-04-09 12:24 [PATCH net-next] net: enetc: fix array underflow in error handling code Dan Carpenter
@ 2021-04-09 12:46 ` Claudiu Manoil
2021-04-09 12:55 ` Vladimir Oltean
2021-04-10 0:40 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: Claudiu Manoil @ 2021-04-09 12:46 UTC (permalink / raw)
To: Dan Carpenter
Cc: David S. Miller, Jakub Kicinski, Vladimir Oltean, netdev,
kernel-janitors
>-----Original Message-----
>From: Dan Carpenter <dan.carpenter@oracle.com>
[...]
>Subject: [PATCH net-next] net: enetc: fix array underflow in error handling
>code
>
>This loop will try to unmap enetc_unmap_tx_buff[-1] and crash.
>
>Fixes: 9d2b68cc108d ("net: enetc: add support for XDP_REDIRECT")
>Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Claudiu Manoil <claudiu.manoil@nxp.com>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net-next] net: enetc: fix array underflow in error handling code
2021-04-09 12:24 [PATCH net-next] net: enetc: fix array underflow in error handling code Dan Carpenter
2021-04-09 12:46 ` Claudiu Manoil
@ 2021-04-09 12:55 ` Vladimir Oltean
2021-04-10 0:40 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: Vladimir Oltean @ 2021-04-09 12:55 UTC (permalink / raw)
To: Dan Carpenter
Cc: Claudiu Manoil, David S. Miller, Jakub Kicinski, netdev, kernel-janitors
On Fri, Apr 09, 2021 at 03:24:28PM +0300, Dan Carpenter wrote:
> This loop will try to unmap enetc_unmap_tx_buff[-1] and crash.
>
> Fixes: 9d2b68cc108d ("net: enetc: add support for XDP_REDIRECT")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> drivers/net/ethernet/freescale/enetc/enetc.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c
> index 57049ae97201..d86395775ed0 100644
> --- a/drivers/net/ethernet/freescale/enetc/enetc.c
> +++ b/drivers/net/ethernet/freescale/enetc/enetc.c
> @@ -895,7 +895,7 @@ static int enetc_xdp_frame_to_xdp_tx_swbd(struct enetc_bdr *tx_ring,
> dma = dma_map_single(tx_ring->dev, data, len, DMA_TO_DEVICE);
> if (unlikely(dma_mapping_error(tx_ring->dev, dma))) {
> /* Undo the DMA mapping for all fragments */
> - while (n-- >= 0)
> + while (--n >= 0)
> enetc_unmap_tx_buff(tx_ring, &xdp_tx_arr[n]);
>
> netdev_err(tx_ring->ndev, "DMA map error\n");
> --
> 2.30.2
>
I have no idea what went wrong. I distinctly remember "testing" this by
writing up a small program:
#include <stdio.h>
int main(void)
{
int n = 5;
while (n-- >= 0)
printf("%d\n", n);
return 0;
}
I find myself doing that most of the time when there is a need for an
unrolling loop. I do see that this goes down to -1, I wonder how I
missed it.
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net-next] net: enetc: fix array underflow in error handling code
2021-04-09 12:24 [PATCH net-next] net: enetc: fix array underflow in error handling code Dan Carpenter
2021-04-09 12:46 ` Claudiu Manoil
2021-04-09 12:55 ` Vladimir Oltean
@ 2021-04-10 0:40 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: patchwork-bot+netdevbpf @ 2021-04-10 0:40 UTC (permalink / raw)
To: Dan Carpenter
Cc: claudiu.manoil, davem, kuba, vladimir.oltean, netdev, kernel-janitors
Hello:
This patch was applied to netdev/net-next.git (refs/heads/master):
On Fri, 9 Apr 2021 15:24:28 +0300 you wrote:
> This loop will try to unmap enetc_unmap_tx_buff[-1] and crash.
>
> Fixes: 9d2b68cc108d ("net: enetc: add support for XDP_REDIRECT")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> drivers/net/ethernet/freescale/enetc/enetc.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Here is the summary with links:
- [net-next] net: enetc: fix array underflow in error handling code
https://git.kernel.org/netdev/net-next/c/626b598aa8be
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-04-10 0:40 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-04-09 12:24 [PATCH net-next] net: enetc: fix array underflow in error handling code Dan Carpenter
2021-04-09 12:46 ` Claudiu Manoil
2021-04-09 12:55 ` Vladimir Oltean
2021-04-10 0:40 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).