diff mbox series

[5.10,220/252] gve: Correct SKB queue index validation.

Message ID	20210531130705.480272383@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, David Awogbemila <awogbemila@google.com>, Willem de Brujin <willemb@google.com>, "David S. Miller" <davem@davemloft.net>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.10 220/252] gve: Correct SKB queue index validation. Date: Mon, 31 May 2021 15:14:45 +0200 Message-Id: <20210531130705.480272383@linuxfoundation.org> In-Reply-To: <20210531130657.971257589@linuxfoundation.org> References: <20210531130657.971257589@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,005/252] ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Zbook G8 [5.10,007/252] ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Zbook Fury 17 G8 [5.10,009/252] ALSA: usb-audio: scarlett2: Improve driver startup messages [5.10,010/252] cifs: set server->cipher_type to AES-128-CCM for SMB3.0 [5.10,012/252] iommu/vt-d: Fix sysfs leak in alloc_iommu() [5.10,014/252] perf intel-pt: Fix transaction abort handling [5.10,015/252] perf scripts python: exported-sql-viewer.py: Fix copy to clipboard from Top Calls ... [5.10,017/252] perf scripts python: exported-sql-viewer.py: Fix warning display [5.10,019/252] net: hso: fix control-request directions [5.10,020/252] net/sched: fq_pie: re-factor fix for fq_pie endless loop [5.10,022/252] netfilter: nft_set_pipapo_avx2: Add irq_fpu_usable() check, fallback to non-AVX2 v... [5.10,024/252] mac80211: prevent mixed key and fragment cache attacks [5.10,027/252] mac80211: drop A-MSDUs on old ciphers [5.10,029/252] mac80211: check defrag PN against current frame [5.10,030/252] mac80211: prevent attacks on TKIP/WEP as well [5.10,032/252] mac80211: extend protection against mixed key and fragment cache attacks [5.10,035/252] ath10k: drop fragments with multicast DA for SDIO [5.10,037/252] ath10k: Fix TKIP Michael MIC verification for PCIe [5.10,040/252] dm snapshot: properly fix a crash when an origin has no snapshots [5.10,041/252] drm/amd/pm: correct MGpuFanBoost setting [5.10,042/252] drm/amdgpu/vcn1: add cancel_delayed_work_sync before power gate [5.10,043/252] drm/amdkfd: correct sienna_cichlid SDMA RLC register offset error [5.10,045/252] drm/amdgpu/vcn2.5: add cancel_delayed_work_sync before power gate [5.10,046/252] drm/amdgpu/jpeg2.0: add cancel_delayed_work_sync before power gate [5.10,049/252] selftests/gpio: Fix build when source tree is read only [5.10,051/252] Documentation: seccomp: Fix user notification documentation [5.10,053/252] serial: core: fix suspicious security_locked_down() call [5.10,055/252] thunderbolt: usb4: Fix NVM read buffer bounds and offset issue [5.10,057/252] KVM: X86: Fix vCPU preempted state from guests point of view [5.10,060/252] staging: iio: cdc: ad7746: avoid overwrite of num_channels [5.10,061/252] iio: gyro: fxas21002c: balance runtime power in error path [5.10,063/252] iio: adc: ad7768-1: Fix too small buffer passed to iio_push_to_buffers_with_timest... [5.10,064/252] iio: adc: ad7124: Fix missbalanced regulator enable / disable on error. [5.10,065/252] iio: adc: ad7124: Fix potential overflow due to non sequential channel numbers [5.10,066/252] iio: adc: ad7923: Fix undersized rx buffer. [5.10,068/252] iio: adc: ad7192: Avoid disabling a clock that was never enabled. [5.10,069/252] iio: adc: ad7192: handle regulator voltage error first [5.10,071/252] serial: 8250_dw: Add device HID for new AMD UART controller [5.10,075/252] Revert "irqbypass: do not start cons/prod when failed connect" [5.10,077/252] drivers: base: Fix device link removal [5.10,078/252] serial: tegra: Fix a mask operation that is always true [5.10,082/252] USB: serial: option: add Telit LE910-S1 compositions 0x7010, 0x7011 [5.10,083/252] USB: serial: ftdi_sio: add IDs for IDS GmbH Products [5.10,084/252] USB: serial: pl2303: add device id for ADLINK ND-6530 GC [5.10,086/252] usb: dwc3: gadget: Properly track pending and queued SG [5.10,088/252] usb: typec: mux: Fix matching with typec_altmode_desc [5.10,090/252] Bluetooth: cmtp: fix file refcount when cmtp_attach_device fails [5.10,091/252] fs/nfs: Use fatal_signal_pending instead of signal_pending [5.10,092/252] NFS: fix an incorrect limit in filelayout_decode_layout() [5.10,095/252] NFSv4: Fix v4.0/v4.1 SEEK_DATA return -ENOTSUPP when set NFS_V4_2 config [5.10,097/252] net/mlx5e: reset XPS on error flow if netdev isnt registered yet [5.10,099/252] net/mlx5e: Fix error path of updating netdev queues [5.10,101/252] net/mlx5e: Fix nullptr in add_vlan_push_action() [5.10,103/252] net/mlx5e: Fix null deref accessing lag dev [5.10,104/252] net/mlx4: Fix EEPROM dump support [5.10,106/252] SUNRPC in case of backlog, hand free slots directly to waiting task [5.10,108/252] tipc: wait and exit until all work queues are done [5.10,110/252] spi: spi-fsl-dspi: Fix a resource leak in an error handling path [5.10,112/252] net: dsa: mt7530: fix VLAN traffic leaks [5.10,115/252] net: dsa: sja1105: use 4095 as the private VLAN for untagged traffic [5.10,116/252] net: dsa: sja1105: error out on unsupported PHY mode [5.10,117/252] net: dsa: sja1105: add error handling in sja1105_setup() [5.10,119/252] net: dsa: sja1105: fix VL lookup command packing for P/Q/R/S [5.10,121/252] i2c: mediatek: Disable i2c start_en and clear intr_stat brfore reset [5.10,122/252] i2c: i801: Dont generate an interrupt on bus reset [5.10,123/252] i2c: sh_mobile: Use new clock calculation formulas for RZ/G2E [5.10,124/252] afs: Fix the nlink handling of dir-over-dir rename [5.10,126/252] nvmet-tcp: fix inline data size comparison in nvmet_tcp_queue_response [5.10,128/252] mptcp: drop unconditional pr_warn on bad opt [5.10,131/252] gpio: cadence: Add missing MODULE_DEVICE_TABLE [5.10,132/252] Revert "crypto: cavium/nitrox - add an error message to explain the failure of pci... [5.10,135/252] Revert "serial: max310x: pass return value of spi_register_driver" [5.10,136/252] serial: max310x: unregister uart driver in case of failure and abort [5.10,140/252] net/smc: properly handle workqueue allocation failure [5.10,141/252] Revert "net: caif: replace BUG_ON with recovery code" [5.10,144/252] char: hpet: add checks after calling ioremap [5.10,146/252] ALSA: sb8: Add a comment note regarding an unused pointer [5.10,147/252] Revert "ALSA: usx2y: Fix potential NULL pointer dereference" [5.10,150/252] Revert "ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd()" [5.10,151/252] ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd() [5.10,154/252] Revert "dmaengine: qcom_hidma: Check for driver register failure" [5.10,155/252] dmaengine: qcom_hidma: comment platform_driver_register call [5.10,158/252] Revert "ASoC: cs43130: fix a NULL pointer dereference" [5.10,159/252] ASoC: cs43130: handle errors in cs43130_probe() properly [5.10,162/252] Revert "media: gspca: mt9m111: Check write_bridge for timeout" [5.10,164/252] Revert "media: gspca: Check the return value of write_bridge for timeout" [5.10,166/252] Revert "net: liquidio: fix a NULL pointer dereference" [5.10,168/252] Revert "brcmfmac: add a check for the status of usb_register" [5.10,170/252] btrfs: return whole extents in fiemap [5.10,171/252] scsi: ufs: ufs-mediatek: Fix power down spec violation [5.10,173/252] openrisc: Define memory barrier mb [5.10,175/252] btrfs: release path before starting transaction when cloning inline extent [5.10,177/252] platform/x86: hp-wireless: add AMDs hardware id to the supported list [5.10,180/252] SMB3: incorrect file id in requests compounded with open [5.10,181/252] drm/amd/display: Disconnect non-DP with no EDID [5.10,184/252] drm/amd/amdgpu: fix a potential deadlock in gpu reset [5.10,187/252] block: fix a race between del_gendisk and BLKRRPART [5.10,188/252] linux/bits.h: fix compilation error with GENMASK [5.10,192/252] interconnect: qcom: Add missing MODULE_DEVICE_TABLE [5.10,194/252] net: stmmac: Fix MAC WoL not working if PHY does not support WoL [5.10,195/252] net: ipa: memory region array is variable size [5.10,196/252] vfio-ccw: Check initialized flag in cp_init() [5.10,198/252] net: really orphan skbs tied to closing sk [5.10,200/252] net: fec: fix the potential memory leak in fec_enet_init() [5.10,202/252] net: mdio: thunder: Fix a double free issue in the .remove function [5.10,204/252] cxgb4/ch_ktls: Clear resources when pf4 device is removed [5.10,206/252] tls splice: check SPLICE_F_NONBLOCK instead of MSG_DONTWAIT [5.10,207/252] net: sched: fix packet stuck problem for lockless qdisc [5.10,209/252] net: sched: fix tx action reschedule issue with stopped queue [5.10,210/252] net: hso: check for allocation failure in hso_create_bulk_serial_device() [5.10,211/252] net: bnx2: Fix error return code in bnx2_init_board() [5.10,213/252] bnxt_en: Fix context memory setup for 64K page size. [5.10,214/252] mld: fix panic in mld_newpack() [5.10,218/252] gve: Add NULL pointer checks when freeing irqs. [5.10,220/252] gve: Correct SKB queue index validation. [5.10,221/252] iommu/virtio: Add missing MODULE_DEVICE_TABLE [5.10,223/252] net: hns3: put off calling register_netdev() until client initialize complete [5.10,225/252] cxgb4: avoid accessing registers when clearing filters [5.10,228/252] bpf, offload: Reorder offload callback prepare in verifier [5.10,229/252] bpf: Set mac_len in bpf_skb_change_head [5.10,230/252] ixgbe: fix large MTU request from VF [5.10,232/252] scsi: libsas: Use _safe() loop in sas_resume_port() [5.10,233/252] net: lantiq: fix memory corruption in RX ring [5.10,236/252] net: ethernet: mtk_eth_soc: Fix packet statistics support for MT7628/88 [5.10,239/252] MIPS: alchemy: xxs1500: add gpio-au1000.h header file [5.10,240/252] MIPS: ralink: export rt_sysc_membase for rt2880_wdt.c [5.10,241/252] net: zero-initialize tc skb extension on allocation [5.10,244/252] samples/bpf: Consider frame size in tx_only of xdpsock sample [5.10,246/252] bpftool: Add sock_release help info for cgroup attach/prog load command [5.10,249/252] net: hso: bail out on interrupt URB allocation failure [5.10,251/252] neighbour: Prevent Race condition in neighbour subsytem

Commit Message

Greg KH May 31, 2021, 1:14 p.m. UTC

From: David Awogbemila <awogbemila@google.com>

[ Upstream commit fbd4a28b4fa66faaa7f510c0adc531d37e0a7848 ]

SKBs with skb_get_queue_mapping(skb) == tx_cfg.num_queues should also be
considered invalid.

Fixes: f5cedc84a30d ("gve: Add transmit and receive support")
Signed-off-by: David Awogbemila <awogbemila@google.com>
Acked-by: Willem de Brujin <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/google/gve/gve_tx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff mbox series

Patch

diff --git a/drivers/net/ethernet/google/gve/gve_tx.c b/drivers/net/ethernet/google/gve/gve_tx.c
index 30532ee28dd3..b653197b34d1 100644
--- a/drivers/net/ethernet/google/gve/gve_tx.c
+++ b/drivers/net/ethernet/google/gve/gve_tx.c
@@ -482,7 +482,7 @@  netdev_tx_t gve_tx(struct sk_buff *skb, struct net_device *dev)
 	struct gve_tx_ring *tx;
 	int nsegs;
 
-	WARN(skb_get_queue_mapping(skb) > priv->tx_cfg.num_queues,
+	WARN(skb_get_queue_mapping(skb) >= priv->tx_cfg.num_queues,
 	     "skb queue index out of range");
 	tx = &priv->tx[skb_get_queue_mapping(skb)];
 	if (unlikely(gve_maybe_stop_tx(tx, skb))) {