From: Cong Wang <[email protected]> Date: Sun, 30 Dec 2018 12:43:42 -0800
> __ptr_ring_swap_queue() tries to move pointers from the old > ring to the new one, but it forgets to check if ->producer > is beyond the new size at the end of the operation. This leads > to an out-of-bound access in __ptr_ring_produce() as reported > by syzbot. > > Reported-by: [email protected] > Fixes: 5d49de532002 ("ptr_ring: resize support") > Cc: "Michael S. Tsirkin" <[email protected]> > Cc: John Fastabend <[email protected]> > Cc: Jason Wang <[email protected]> > Signed-off-by: Cong Wang <[email protected]> Applied and queued up for -stable.
