diff options
| author |   David S. Miller <davem@davemloft.net> | 2022-05-11 12:25:07 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2022-05-11 12:25:07 +0100 |
| commit | 2423b0d0724d47897c8a3a988f62aedd3e87ceba (patch) | |
| tree | a976d13be06aee2e681a3ae8fa041dfbcae8e398 /drivers/s390 | |
| parent | net: stmmac: fix missing pci_disable_device() on error in stmmac_pci_probe() (diff) | |
| parent | net: atlantic: verify hw_head_ lies within TX buffer ring (diff) | |
| download | linux-dev-2423b0d0724d47897c8a3a988f62aedd3e87ceba.tar.xz linux-dev-2423b0d0724d47897c8a3a988f62aedd3e87ceba.zip | |
Merge branch 'atlantic-fixes'
Grant Grundler says:
====================
net: atlantic: more fuzzing fixes
It essentially describes four problems:
1) validate rxd_wb->next_desc_ptr before populating buff->next
2) "frag[0] not initialized" case in aq_ring_rx_clean()
3) limit iterations handling fragments in aq_ring_rx_clean()
4) validate hw_head_ in hw_atl_b0_hw_ring_tx_head_update()
(1) was fixed by Zekun Shen <bruceshenzk@gmail.com> around the same time with
"atlantic: Fix buff_ring OOB in aq_ring_rx_clean" (SHA1 5f50153288452e10).
I've added one "clean up" contribution:
"net: atlantic: reduce scope of is_rsc_complete"
I tested the "original" patches using chromeos-v5.4 kernel branch:
https://chromium-review.googlesource.com/q/hashtag:pcinet-atlantic-2022q1+(status:open%20OR%20status:merged)
I've forward ported those patches to 5.18-rc2 and compiled them but am
unable to test them on 5.18-rc2 kernel (logistics problems).
Credit largely goes to ChromeOS Fuzzing team members:
Aashay Shringarpure, Yi Chou, Shervin Oloumi
V2 changes:
o drop first patch - was already fixed upstream differently
o reduce (4) "validate hw_head_" to simple bounds checking.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/s390')
0 files changed, 0 insertions, 0 deletions