lkml.org 
[lkml]   [2021]   [Dec]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
SubjectRe: [syzbot] general protection fault in sg_alloc_append_table_from_pages
From
On 10/13/21 19:51, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 717478d89fe2 Merge tag 'riscv-for-linus-5.15-rc5' of git:/..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=12489abf300000
> kernel config: https://syzkaller.appspot.com/x/.config?x=32e6048063923b7b
> dashboard link: https://syzkaller.appspot.com/bug?extid=2c56b725ec547fa9cb29
> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=167b9e4f300000
>
> The issue was bisected to:
>
> commit 284562e1f34874e267d4f499362c3816f8f6bc3f
> Author: Gurchetan Singh <gurchetansingh@chromium.org>
> Date: Tue Dec 3 01:36:27 2019 +0000
>
> udmabuf: implement begin_cpu_access/end_cpu_access hooks
>
> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=12d68447300000
> final oops: https://syzkaller.appspot.com/x/report.txt?x=11d68447300000
> console output: https://syzkaller.appspot.com/x/log.txt?x=16d68447300000
>

zero ubuf->pagecount will cause kmalloc_array() to return ZERO_PTR, that
is unsafe to deref

#syz test
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master



With regards,
Pavel Skripkindiff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c
index c57a609db75b..e7330684d3b8 100644
--- a/drivers/dma-buf/udmabuf.c
+++ b/drivers/dma-buf/udmabuf.c
@@ -190,6 +190,10 @@ static long udmabuf_create(struct miscdevice *device,
if (ubuf->pagecount > pglimit)
goto err;
}
+
+ if (!ubuf->pagecount)
+ goto err;
+
ubuf->pages = kmalloc_array(ubuf->pagecount, sizeof(*ubuf->pages),
GFP_KERNEL);
if (!ubuf->pages) {
\
 
 \ /
  Last update: 2021-12-30 14:54    [W:1.003 / U:0.040 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site