Re: [PATCH net] ptr_ring: use kmalloc_array()

2017-08-25 Thread Eric Dumazet
On Fri, 2017-08-25 at 22:25 +0300, Michael S. Tsirkin wrote: > On Fri, Aug 25, 2017 at 11:57:19AM -0700, Eric Dumazet wrote: > > On Fri, 2017-08-25 at 21:03 +0300, Michael S. Tsirkin wrote: > > > On Wed, Aug 16, 2017 at 10:36:47AM -0700, Eric Dumazet wrote: > > > > From: Eric Dumazet > > > > > >

Re: [PATCH net] ptr_ring: use kmalloc_array()

2017-08-25 Thread Michael S. Tsirkin
On Fri, Aug 25, 2017 at 11:57:19AM -0700, Eric Dumazet wrote: > On Fri, 2017-08-25 at 21:03 +0300, Michael S. Tsirkin wrote: > > On Wed, Aug 16, 2017 at 10:36:47AM -0700, Eric Dumazet wrote: > > > From: Eric Dumazet > > > > > > As found by syzkaller, malicious users can set whatever tx_queue_len

Re: [PATCH net] ptr_ring: use kmalloc_array()

2017-08-25 Thread Eric Dumazet
On Fri, 2017-08-25 at 21:03 +0300, Michael S. Tsirkin wrote: > On Wed, Aug 16, 2017 at 10:36:47AM -0700, Eric Dumazet wrote: > > From: Eric Dumazet > > > > As found by syzkaller, malicious users can set whatever tx_queue_len > > on a tun device and eventually crash the kernel. > > > > Lets remov

Re: [PATCH net] ptr_ring: use kmalloc_array()

2017-08-25 Thread Michael S. Tsirkin
On Wed, Aug 16, 2017 at 10:36:47AM -0700, Eric Dumazet wrote: > From: Eric Dumazet > > As found by syzkaller, malicious users can set whatever tx_queue_len > on a tun device and eventually crash the kernel. > > Lets remove the ALIGN(XXX, SMP_CACHE_BYTES) thing since a small > ring buffer is not

Re: [PATCH net] ptr_ring: use kmalloc_array()

2017-08-16 Thread David Miller
From: Eric Dumazet Date: Wed, 16 Aug 2017 10:36:47 -0700 > From: Eric Dumazet > > As found by syzkaller, malicious users can set whatever tx_queue_len > on a tun device and eventually crash the kernel. > > Lets remove the ALIGN(XXX, SMP_CACHE_BYTES) thing since a small > ring buffer is not fas

[PATCH net] ptr_ring: use kmalloc_array()

2017-08-16 Thread Eric Dumazet
From: Eric Dumazet As found by syzkaller, malicious users can set whatever tx_queue_len on a tun device and eventually crash the kernel. Lets remove the ALIGN(XXX, SMP_CACHE_BYTES) thing since a small ring buffer is not fast anyway. Fixes: 2e0ab8ca83c1 ("ptr_ring: array based FIFO for pointers"