Re: [BUG] net: chelsio: Possible buffer overflow caused by DMA failures/attacks

2020-05-05 Thread Greg KH
On Tue, May 05, 2020 at 11:50:28PM +0800, Jia-Ju Bai wrote: > In alloc_rx_resources(): >     sge->respQ.entries = >         pci_alloc_consistent(pdev, size, &sge->respQ.dma_addr); > > Thus, "sge->respQ.entries" is a DMA value, and it is assigned to > "e" in process_pure_responses(): >     struct s

[BUG] net: chelsio: Possible buffer overflow caused by DMA failures/attacks

2020-05-05 Thread Jia-Ju Bai
In alloc_rx_resources():     sge->respQ.entries =         pci_alloc_consistent(pdev, size, &sge->respQ.dma_addr); Thus, "sge->respQ.entries" is a DMA value, and it is assigned to "e" in process_pure_responses():     struct sge *sge = adapter->sge;     struct respQ *q = &sge->respQ;     struct res