1. 24 4月, 2021 3 次提交
    • D
      net: mana: Use int to check the return value of mana_gd_poll_cq() · d90a9468
      Dexuan Cui 提交于
      mana_gd_poll_cq() may return -1 if an overflow error is detected (this
      should never happen unless there is a bug in the driver or the hardware).
      
      Fix the type of the variable "comp_read" by using int rather than u32.
      Reported-by: NDan Carpenter <dan.carpenter@oracle.com>
      Fixes: ca9c54d2 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)")
      Signed-off-by: NDexuan Cui <decui@microsoft.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      d90a9468
    • X
      virtio-net: fix use-after-free in skb_gro_receive · f80bd740
      Xuan Zhuo 提交于
      When "headroom" > 0, the actual allocated memory space is the entire
      page, so the address of the page should be used when passing it to
      build_skb().
      
      BUG: KASAN: use-after-free in skb_gro_receive (net/core/skbuff.c:4260)
      Write of size 16 at addr ffff88811619fffc by task kworker/u9:0/534
      CPU: 2 PID: 534 Comm: kworker/u9:0 Not tainted 5.12.0-rc7-custom-16372-gb150be05b806 #3382
      Hardware name: QEMU MSN2700, BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
      Workqueue: xprtiod xs_stream_data_receive_workfn [sunrpc]
      Call Trace:
       <IRQ>
      dump_stack (lib/dump_stack.c:122)
      print_address_description.constprop.0 (mm/kasan/report.c:233)
      kasan_report.cold (mm/kasan/report.c:400 mm/kasan/report.c:416)
      skb_gro_receive (net/core/skbuff.c:4260)
      tcp_gro_receive (net/ipv4/tcp_offload.c:266 (discriminator 1))
      tcp4_gro_receive (net/ipv4/tcp_offload.c:316)
      inet_gro_receive (net/ipv4/af_inet.c:1545 (discriminator 2))
      dev_gro_receive (net/core/dev.c:6075)
      napi_gro_receive (net/core/dev.c:6168 net/core/dev.c:6198)
      receive_buf (drivers/net/virtio_net.c:1151) virtio_net
      virtnet_poll (drivers/net/virtio_net.c:1415 drivers/net/virtio_net.c:1519) virtio_net
      __napi_poll (net/core/dev.c:6964)
      net_rx_action (net/core/dev.c:7033 net/core/dev.c:7118)
      __do_softirq (./arch/x86/include/asm/jump_label.h:25 ./include/linux/jump_label.h:200 ./include/trace/events/irq.h:142 kernel/softirq.c:346)
      irq_exit_rcu (kernel/softirq.c:221 kernel/softirq.c:422 kernel/softirq.c:434)
      common_interrupt (arch/x86/kernel/irq.c:240 (discriminator 14))
      </IRQ>
      
      Fixes: fb32856b ("virtio-net: page_to_skb() use build_skb when there's sufficient tailroom")
      Signed-off-by: NXuan Zhuo <xuanzhuo@linux.alibaba.com>
      Reported-by: NIdo Schimmel <idosch@nvidia.com>
      Tested-by: NIdo Schimmel <idosch@nvidia.com>
      Acked-by: NJason Wang <jasowang@redhat.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      f80bd740
    • T
      net: sock: remove the unnecessary check in proto_register · ed744d81
      Tonghao Zhang 提交于
      tw_prot_cleanup will check the twsk_prot.
      
      Fixes: 0f5907af ("net: Fix potential memory leak in proto_register()")
      Cc: Miaohe Lin <linmiaohe@huawei.com>
      Signed-off-by: NTonghao Zhang <xiangxia.m.yue@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      ed744d81
  2. 23 4月, 2021 23 次提交
  3. 22 4月, 2021 14 次提交