Messages in this thread | | | Date | Wed, 12 Jan 2022 21:08:46 +0300 | Subject | Re: [PATCH] udmabuf: validate ubuf->pagecount | From | Pavel Skripkin <> |
| |
On 12/30/21 17:26, Pavel Skripkin wrote: > Syzbot has reported GPF in sg_alloc_append_table_from_pages(). The > problem was in ubuf->pages == ZERO_PTR. > > ubuf->pagecount is calculated from arguments passed from user-space. If > user creates udmabuf with list.size == 0 then ubuf->pagecount will be > also equal to zero; it causes kmalloc_array() to return ZERO_PTR. > > Fix it by validating ubuf->pagecount before passing it to > kmalloc_array(). > > Fixes: fbb0de795078 ("Add udmabuf misc device") > Reported-and-tested-by: syzbot+2c56b725ec547fa9cb29@syzkaller.appspotmail.com > Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> > --- >
Gentle ping :)
> > --- > drivers/dma-buf/udmabuf.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c > index c57a609db75b..e7330684d3b8 100644 > --- a/drivers/dma-buf/udmabuf.c > +++ b/drivers/dma-buf/udmabuf.c > @@ -190,6 +190,10 @@ static long udmabuf_create(struct miscdevice *device, > if (ubuf->pagecount > pglimit) > goto err; > } > + > + if (!ubuf->pagecount) > + goto err; > + > ubuf->pages = kmalloc_array(ubuf->pagecount, sizeof(*ubuf->pages), > GFP_KERNEL); > if (!ubuf->pages) {
With regards, Pavel Skripkin
| |