From patchwork Tue Mar 9 20:51:07 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ricardo Ribalda X-Patchwork-Id: 397075 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.2 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, UNWANTED_LANGUAGE_BODY,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3DE50C433E6 for ; Tue, 9 Mar 2021 20:52:11 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 0FA316526C for ; Tue, 9 Mar 2021 20:52:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231872AbhCIUvj (ORCPT ); Tue, 9 Mar 2021 15:51:39 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56976 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231859AbhCIUvN (ORCPT ); Tue, 9 Mar 2021 15:51:13 -0500 Received: from mail-ej1-x634.google.com (mail-ej1-x634.google.com [IPv6:2a00:1450:4864:20::634]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B9537C06175F for ; Tue, 9 Mar 2021 12:51:12 -0800 (PST) Received: by mail-ej1-x634.google.com with SMTP id lr13so31643142ejb.8 for ; Tue, 09 Mar 2021 12:51:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=gWcqe+g4PYvymlA7EinAD2uSQgU+3l68r0HRW1HJRww=; b=crrbLNlQsrwE5LqsAy+1poy/6Ac6lfVlWoix+jdBu3iWgoNmnANhkpg8cyIQf9GUOE bYjtzXXamzIoCBBS/cfqfNJglpksRte2VZDslKuNjWe/4xuhwspYqUOHhSdZQ1Rfoinp AxNT4t1fw9R3Pk370D2M/454sCONqE7vTewfo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=gWcqe+g4PYvymlA7EinAD2uSQgU+3l68r0HRW1HJRww=; b=Zbk5vWm53Dmlp1nK+1q5Q/XvbtmTPBvBS6+eDADI0nAPTg5x1iU9tiFm1z8GdcmCsa kYBENBiK/fuaiMji2dcIclFmmh3DgmEXPH6j0RWh0TgZobEREpEWU7euabxOWZ+tdKSk r0cca5Tbg0UrcL3fX5I53v3bOsYxNpCkrMNN8u0PclYt+F4KXTPn+uwW9/h1lYlDYXgD v6Mo3ToixsmfUm9XvWMPwA+xmCbKMKLm1RQw1ucD7M9pYjYwnVriqYLd5vN0niTFFPpb 1bxVlbj/octRjwlUWNAaGMFjlroO18EGThUtyguhOoLk72EQfGCTUCJUlhBlY0eKQq/A xPgg== X-Gm-Message-State: AOAM531WCsqFUHLhrIifQ8TeaBADIp1OpeV0Krr5MggpZ+sf7i2p97cA 4Jw1D6oj7fbdBp0YELNQg0R8Bw== X-Google-Smtp-Source: ABdhPJxA5gE3B9NFp5PkqdN0pK/gj7+CwSk1Uy/wi/8Bp89EhqExlMOpBEbEGsjaXieJIlj/0qPXMw== X-Received: by 2002:a17:906:150f:: with SMTP id b15mr13427176ejd.363.1615323071549; Tue, 09 Mar 2021 12:51:11 -0800 (PST) Received: from alco.lan ([80.71.134.83]) by smtp.gmail.com with ESMTPSA id mc10sm8861190ejb.56.2021.03.09.12.51.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 09 Mar 2021 12:51:11 -0800 (PST) From: Ricardo Ribalda To: Tomasz Figa , Marek Szyprowski , Mauro Carvalho Chehab , Daniel Vetter , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Ricardo Ribalda , stable@vger.kernel.org Subject: [PATCH 1/2] lib/scatterlist: Fix NULL pointer deference Date: Tue, 9 Mar 2021 21:51:07 +0100 Message-Id: <20210309205108.997166-1-ribalda@chromium.org> X-Mailer: git-send-email 2.30.1.766.gb4fecdf3b7-goog MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org When sg_alloc_table_from_pages is called with n_pages = 0, we write in a non-allocated page. Fix it by checking early the error condition. [ 7.666801] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ 7.667487] #PF: supervisor read access in kernel mode [ 7.667970] #PF: error_code(0x0000) - not-present page [ 7.668448] PGD 0 P4D 0 [ 7.668690] Oops: 0000 [#1] SMP NOPTI [ 7.669037] CPU: 0 PID: 184 Comm: modprobe Not tainted 5.11.0+ #2 [ 7.669606] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 [ 7.670378] RIP: 0010:__sg_alloc_table_from_pages+0x2c5/0x4a0 [ 7.670924] Code: c9 01 48 c7 40 08 00 00 00 00 48 89 08 8b 47 0c 41 8d 44 00 ff 89 47 0c 48 81 fa 00 f0 ff ff 0f 87 d4 01 00 00 49 8b 16 89 d8 <4a> 8b 74 fd 00 4c 89 d1 44 29 f8 c1 e0 0c 44 29 d8 4c 39 d0 48 0f [ 7.672643] RSP: 0018:ffffba1e8028fb30 EFLAGS: 00010287 [ 7.673133] RAX: 0000000000000001 RBX: 0000000000000001 RCX: 0000000000000002 [ 7.673791] RDX: 0000000000000002 RSI: ffffffffada6d0ba RDI: ffff9afe01fff820 [ 7.674448] RBP: 0000000000000010 R08: 0000000000000001 R09: 0000000000000001 [ 7.675100] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 7.675754] R13: 00000000fffff000 R14: ffff9afe01fff800 R15: 0000000000000000 [ 7.676409] FS: 00007fb0f448f540(0000) GS:ffff9afe07a00000(0000) knlGS:0000000000000000 [ 7.677151] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 7.677681] CR2: 0000000000000010 CR3: 0000000002184001 CR4: 0000000000370ef0 [ 7.678342] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 7.679019] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 7.680349] Call Trace: [ 7.680605] ? device_add+0x146/0x810 [ 7.681021] sg_alloc_table_from_pages+0x11/0x30 [ 7.681511] vb2_dma_sg_alloc+0x162/0x280 [videobuf2_dma_sg] Cc: stable@vger.kernel.org Fixes: efc42bc98058 ("scatterlist: add sg_alloc_table_from_pages function") Signed-off-by: Ricardo Ribalda --- lib/scatterlist.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/lib/scatterlist.c b/lib/scatterlist.c index a59778946404..1e83b6a3d930 100644 --- a/lib/scatterlist.c +++ b/lib/scatterlist.c @@ -435,6 +435,9 @@ struct scatterlist *__sg_alloc_table_from_pages(struct sg_table *sgt, unsigned int added_nents = 0; struct scatterlist *s = prv; + if (n_pages == 0) + return ERR_PTR(-EINVAL); + /* * The algorithm below requires max_segment to be aligned to PAGE_SIZE * otherwise it can overshoot. From patchwork Tue Mar 9 20:51:08 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ricardo Ribalda X-Patchwork-Id: 396367 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 175D6C433DB for ; Tue, 9 Mar 2021 20:52:11 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id DDAD065243 for ; Tue, 9 Mar 2021 20:52:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231790AbhCIUvi (ORCPT ); Tue, 9 Mar 2021 15:51:38 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56982 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231864AbhCIUvN (ORCPT ); Tue, 9 Mar 2021 15:51:13 -0500 Received: from mail-ed1-x52e.google.com (mail-ed1-x52e.google.com [IPv6:2a00:1450:4864:20::52e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4223FC06174A for ; Tue, 9 Mar 2021 12:51:13 -0800 (PST) Received: by mail-ed1-x52e.google.com with SMTP id b13so23169581edx.1 for ; Tue, 09 Mar 2021 12:51:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=q+LXPS2g/C2kk8K3V/x2NSnGympAYYgTq9AwkJ/pVJg=; b=K1IwR7nekABeEPYTpc4sfCNOmMmM69FNHkZxRzFj0qH5RZWU9XImYZzmlE0RnWRh03 F0CTTqCA0DSvbgqIBvUzbrZXpvHL1YQJEs9xGLp83Z5EbjgQjwPiEVTTuLNLmFa9QNmh PhaCKqXzEEY5ATbSploSh7okQTotlAOa7D8ro= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=q+LXPS2g/C2kk8K3V/x2NSnGympAYYgTq9AwkJ/pVJg=; b=L+DIuxlwB+Ks+o5Ate8WADG730IGySypcLLZTFXAZdGIQ+G1WEVfQzoWxVxbI4Nz9T tVwVShPdxYLYGa9bjm+Hy+dZKHIDxIVkW7MadxQpFk+rJh5yS76OsDNpzJTB+12vbSvc elyblUUro5bfGqPmvC8ATrOCzIJwTAQdDyfy0mJFv6gKxN2AQQkSXBSoed9EqijnZuSp ScSG3IBbW44Dk2qHm+Drm63TrL5drcZJMF/KdmD9JcQ7PPzmjtzBIV2E4EvW3BaRSbVB mAzR9QVBCoeckzckh8shEkWhPjBYvomOCdLxEpH3+rsqVXpYxJOAsU1j5VCJ1FRr8IAv Zxtw== X-Gm-Message-State: AOAM532nwFTb2zfuilHhsxEbQb5sPzBbrQaRv2vp7OeroMb6begGdlay 96ik81XQrNDjBL6HK1dzbRkM+Q== X-Google-Smtp-Source: ABdhPJxnRoBhZTMo7aEzAdv4A87Pfu3GiwuHUGUxLoppCuiln29NC3PVmEVw94505C+/DTTrS7jsCQ== X-Received: by 2002:aa7:c6da:: with SMTP id b26mr6426641eds.254.1615323072076; Tue, 09 Mar 2021 12:51:12 -0800 (PST) Received: from alco.lan ([80.71.134.83]) by smtp.gmail.com with ESMTPSA id mc10sm8861190ejb.56.2021.03.09.12.51.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 09 Mar 2021 12:51:11 -0800 (PST) From: Ricardo Ribalda To: Tomasz Figa , Marek Szyprowski , Mauro Carvalho Chehab , Daniel Vetter , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Ricardo Ribalda Subject: [PATCH 2/2] media: videobuf2: Exit promptly if size = 0 Date: Tue, 9 Mar 2021 21:51:08 +0100 Message-Id: <20210309205108.997166-2-ribalda@chromium.org> X-Mailer: git-send-email 2.30.1.766.gb4fecdf3b7-goog In-Reply-To: <20210309205108.997166-1-ribalda@chromium.org> References: <20210309205108.997166-1-ribalda@chromium.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org Exit as soon as possible if a driver wants to allocate a buffer of size 0, and print a warning to help fixing the issue. Signed-off-by: Ricardo Ribalda --- drivers/media/common/videobuf2/videobuf2-dma-sg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/common/videobuf2/videobuf2-dma-sg.c b/drivers/media/common/videobuf2/videobuf2-dma-sg.c index 030e48218687..c5b06a509566 100644 --- a/drivers/media/common/videobuf2/videobuf2-dma-sg.c +++ b/drivers/media/common/videobuf2/videobuf2-dma-sg.c @@ -105,7 +105,7 @@ static void *vb2_dma_sg_alloc(struct device *dev, unsigned long dma_attrs, int ret; int num_pages; - if (WARN_ON(!dev)) + if (WARN_ON(!dev) || WARN_ON(!size)) return ERR_PTR(-EINVAL); buf = kzalloc(sizeof *buf, GFP_KERNEL);