Messages in this thread Patch in this message | | | Date | Thu, 30 Dec 2021 16:53:21 +0300 | Subject | Re: [syzbot] general protection fault in sg_alloc_append_table_from_pages | From | Pavel Skripkin <> |
| |
On 10/13/21 19:51, syzbot wrote: > Hello, > > syzbot found the following issue on: > > HEAD commit: 717478d89fe2 Merge tag 'riscv-for-linus-5.15-rc5' of git:/.. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=12489abf300000 > kernel config: https://syzkaller.appspot.com/x/.config?x=32e6048063923b7b > dashboard link: https://syzkaller.appspot.com/bug?extid=2c56b725ec547fa9cb29 > compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=167b9e4f300000 > > The issue was bisected to: > > commit 284562e1f34874e267d4f499362c3816f8f6bc3f > Author: Gurchetan Singh <gurchetansingh@chromium.org> > Date: Tue Dec 3 01:36:27 2019 +0000 > > udmabuf: implement begin_cpu_access/end_cpu_access hooks > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=12d68447300000 > final oops: https://syzkaller.appspot.com/x/report.txt?x=11d68447300000 > console output: https://syzkaller.appspot.com/x/log.txt?x=16d68447300000 >
zero ubuf->pagecount will cause kmalloc_array() to return ZERO_PTR, that is unsafe to deref
#syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
With regards, Pavel Skripkindiff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c index c57a609db75b..e7330684d3b8 100644 --- a/drivers/dma-buf/udmabuf.c +++ b/drivers/dma-buf/udmabuf.c @@ -190,6 +190,10 @@ static long udmabuf_create(struct miscdevice *device, if (ubuf->pagecount > pglimit) goto err; } + + if (!ubuf->pagecount) + goto err; + ubuf->pages = kmalloc_array(ubuf->pagecount, sizeof(*ubuf->pages), GFP_KERNEL); if (!ubuf->pages) { | |