| Message ID | 20211230142649.23022-1-paskripkin@gmail.com |
|---|---|
| State | Accepted |
| Commit | 2b6dd600dd72573c23ea180b5b0b2f1813405882 |
| Headers | show |
| Series | udmabuf: validate ubuf->pagecount | expand |
On 12/30/21 17:26, Pavel Skripkin wrote: > Syzbot has reported GPF in sg_alloc_append_table_from_pages(). The > problem was in ubuf->pages == ZERO_PTR. > > ubuf->pagecount is calculated from arguments passed from user-space. If > user creates udmabuf with list.size == 0 then ubuf->pagecount will be > also equal to zero; it causes kmalloc_array() to return ZERO_PTR. > > Fix it by validating ubuf->pagecount before passing it to > kmalloc_array(). > > Fixes: fbb0de795078 ("Add udmabuf misc device") > Reported-and-tested-by: syzbot+2c56b725ec547fa9cb29@syzkaller.appspotmail.com > Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> > --- > Gentle ping :) > > --- > drivers/dma-buf/udmabuf.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c > index c57a609db75b..e7330684d3b8 100644 > --- a/drivers/dma-buf/udmabuf.c > +++ b/drivers/dma-buf/udmabuf.c > @@ -190,6 +190,10 @@ static long udmabuf_create(struct miscdevice *device, > if (ubuf->pagecount > pglimit) > goto err; > } > + > + if (!ubuf->pagecount) > + goto err; > + > ubuf->pages = kmalloc_array(ubuf->pagecount, sizeof(*ubuf->pages), > GFP_KERNEL); > if (!ubuf->pages) { With regards, Pavel Skripkin
On Wed, Jan 12, 2022 at 09:08:46PM +0300, Pavel Skripkin wrote: > On 12/30/21 17:26, Pavel Skripkin wrote: > > Syzbot has reported GPF in sg_alloc_append_table_from_pages(). The > > problem was in ubuf->pages == ZERO_PTR. > > > > ubuf->pagecount is calculated from arguments passed from user-space. If > > user creates udmabuf with list.size == 0 then ubuf->pagecount will be > > also equal to zero; it causes kmalloc_array() to return ZERO_PTR. > > > > Fix it by validating ubuf->pagecount before passing it to > > kmalloc_array(). > > > > Fixes: fbb0de795078 ("Add udmabuf misc device") > > Reported-and-tested-by: syzbot+2c56b725ec547fa9cb29@syzkaller.appspotmail.com > > Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> > > --- > > > > Gentle ping :) Gerd Hoffmann should pick this one up, pls holler again if it doesn't happen. -Daniel > > > > > --- > > drivers/dma-buf/udmabuf.c | 4 ++++ > > 1 file changed, 4 insertions(+) > > > > diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c > > index c57a609db75b..e7330684d3b8 100644 > > --- a/drivers/dma-buf/udmabuf.c > > +++ b/drivers/dma-buf/udmabuf.c > > @@ -190,6 +190,10 @@ static long udmabuf_create(struct miscdevice *device, > > if (ubuf->pagecount > pglimit) > > goto err; > > } > > + > > + if (!ubuf->pagecount) > > + goto err; > > + > > ubuf->pages = kmalloc_array(ubuf->pagecount, sizeof(*ubuf->pages), > > GFP_KERNEL); > > if (!ubuf->pages) { > > With regards, > Pavel Skripkin
diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c index c57a609db75b..e7330684d3b8 100644 --- a/drivers/dma-buf/udmabuf.c +++ b/drivers/dma-buf/udmabuf.c @@ -190,6 +190,10 @@ static long udmabuf_create(struct miscdevice *device, if (ubuf->pagecount > pglimit) goto err; } + + if (!ubuf->pagecount) + goto err; + ubuf->pages = kmalloc_array(ubuf->pagecount, sizeof(*ubuf->pages), GFP_KERNEL); if (!ubuf->pages) {
Syzbot has reported GPF in sg_alloc_append_table_from_pages(). The problem was in ubuf->pages == ZERO_PTR. ubuf->pagecount is calculated from arguments passed from user-space. If user creates udmabuf with list.size == 0 then ubuf->pagecount will be also equal to zero; it causes kmalloc_array() to return ZERO_PTR. Fix it by validating ubuf->pagecount before passing it to kmalloc_array(). Fixes: fbb0de795078 ("Add udmabuf misc device") Reported-and-tested-by: syzbot+2c56b725ec547fa9cb29@syzkaller.appspotmail.com Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> --- Happy New Year and Merry Christmas! :) With regards, Pavel Skripkin --- drivers/dma-buf/udmabuf.c | 4 ++++ 1 file changed, 4 insertions(+)