* [PATCH] udmabuf: validate ubuf->pagecount
@ 2021-12-30 14:26 ` Pavel Skripkin
0 siblings, 0 replies; 8+ messages in thread
From: Pavel Skripkin @ 2021-12-30 14:26 UTC (permalink / raw)
To: kraxel, sumit.semwal, christian.koenig, daniel.vetter
Cc: dri-devel, linux-media, linaro-mm-sig, linux-kernel,
Pavel Skripkin, syzbot+2c56b725ec547fa9cb29
Syzbot has reported GPF in sg_alloc_append_table_from_pages(). The
problem was in ubuf->pages == ZERO_PTR.
ubuf->pagecount is calculated from arguments passed from user-space. If
user creates udmabuf with list.size == 0 then ubuf->pagecount will be
also equal to zero; it causes kmalloc_array() to return ZERO_PTR.
Fix it by validating ubuf->pagecount before passing it to
kmalloc_array().
Fixes: fbb0de795078 ("Add udmabuf misc device")
Reported-and-tested-by: syzbot+2c56b725ec547fa9cb29@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
---
Happy New Year and Merry Christmas! :)
With regards,
Pavel Skripkin
---
drivers/dma-buf/udmabuf.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c
index c57a609db75b..e7330684d3b8 100644
--- a/drivers/dma-buf/udmabuf.c
+++ b/drivers/dma-buf/udmabuf.c
@@ -190,6 +190,10 @@ static long udmabuf_create(struct miscdevice *device,
if (ubuf->pagecount > pglimit)
goto err;
}
+
+ if (!ubuf->pagecount)
+ goto err;
+
ubuf->pages = kmalloc_array(ubuf->pagecount, sizeof(*ubuf->pages),
GFP_KERNEL);
if (!ubuf->pages) {
--
2.34.1
^ permalink raw reply related [flat|nested] 8+ messages in thread* [PATCH] udmabuf: validate ubuf->pagecount
@ 2021-12-30 14:26 ` Pavel Skripkin
0 siblings, 0 replies; 8+ messages in thread
From: Pavel Skripkin @ 2021-12-30 14:26 UTC (permalink / raw)
To: kraxel, sumit.semwal, christian.koenig, daniel.vetter
Cc: Pavel Skripkin, linux-kernel, dri-devel, linaro-mm-sig,
syzbot+2c56b725ec547fa9cb29, linux-media
Syzbot has reported GPF in sg_alloc_append_table_from_pages(). The
problem was in ubuf->pages == ZERO_PTR.
ubuf->pagecount is calculated from arguments passed from user-space. If
user creates udmabuf with list.size == 0 then ubuf->pagecount will be
also equal to zero; it causes kmalloc_array() to return ZERO_PTR.
Fix it by validating ubuf->pagecount before passing it to
kmalloc_array().
Fixes: fbb0de795078 ("Add udmabuf misc device")
Reported-and-tested-by: syzbot+2c56b725ec547fa9cb29@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
---
Happy New Year and Merry Christmas! :)
With regards,
Pavel Skripkin
---
drivers/dma-buf/udmabuf.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c
index c57a609db75b..e7330684d3b8 100644
--- a/drivers/dma-buf/udmabuf.c
+++ b/drivers/dma-buf/udmabuf.c
@@ -190,6 +190,10 @@ static long udmabuf_create(struct miscdevice *device,
if (ubuf->pagecount > pglimit)
goto err;
}
+
+ if (!ubuf->pagecount)
+ goto err;
+
ubuf->pages = kmalloc_array(ubuf->pagecount, sizeof(*ubuf->pages),
GFP_KERNEL);
if (!ubuf->pages) {
--
2.34.1
^ permalink raw reply related [flat|nested] 8+ messages in thread* Re: [PATCH] udmabuf: validate ubuf->pagecount
2021-12-30 14:26 ` Pavel Skripkin
@ 2022-01-12 18:08 ` Pavel Skripkin
-1 siblings, 0 replies; 8+ messages in thread
From: Pavel Skripkin @ 2022-01-12 18:08 UTC (permalink / raw)
To: kraxel, sumit.semwal, christian.koenig, daniel.vetter
Cc: linaro-mm-sig, syzbot+2c56b725ec547fa9cb29, linux-kernel,
dri-devel, linux-media
On 12/30/21 17:26, Pavel Skripkin wrote:
> Syzbot has reported GPF in sg_alloc_append_table_from_pages(). The
> problem was in ubuf->pages == ZERO_PTR.
>
> ubuf->pagecount is calculated from arguments passed from user-space. If
> user creates udmabuf with list.size == 0 then ubuf->pagecount will be
> also equal to zero; it causes kmalloc_array() to return ZERO_PTR.
>
> Fix it by validating ubuf->pagecount before passing it to
> kmalloc_array().
>
> Fixes: fbb0de795078 ("Add udmabuf misc device")
> Reported-and-tested-by: syzbot+2c56b725ec547fa9cb29@syzkaller.appspotmail.com
> Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
> ---
>
Gentle ping :)
>
> ---
> drivers/dma-buf/udmabuf.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c
> index c57a609db75b..e7330684d3b8 100644
> --- a/drivers/dma-buf/udmabuf.c
> +++ b/drivers/dma-buf/udmabuf.c
> @@ -190,6 +190,10 @@ static long udmabuf_create(struct miscdevice *device,
> if (ubuf->pagecount > pglimit)
> goto err;
> }
> +
> + if (!ubuf->pagecount)
> + goto err;
> +
> ubuf->pages = kmalloc_array(ubuf->pagecount, sizeof(*ubuf->pages),
> GFP_KERNEL);
> if (!ubuf->pages) {
With regards,
Pavel Skripkin
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH] udmabuf: validate ubuf->pagecount
@ 2022-01-12 18:08 ` Pavel Skripkin
0 siblings, 0 replies; 8+ messages in thread
From: Pavel Skripkin @ 2022-01-12 18:08 UTC (permalink / raw)
To: kraxel, sumit.semwal, christian.koenig, daniel.vetter
Cc: dri-devel, linux-media, linaro-mm-sig, linux-kernel,
syzbot+2c56b725ec547fa9cb29
On 12/30/21 17:26, Pavel Skripkin wrote:
> Syzbot has reported GPF in sg_alloc_append_table_from_pages(). The
> problem was in ubuf->pages == ZERO_PTR.
>
> ubuf->pagecount is calculated from arguments passed from user-space. If
> user creates udmabuf with list.size == 0 then ubuf->pagecount will be
> also equal to zero; it causes kmalloc_array() to return ZERO_PTR.
>
> Fix it by validating ubuf->pagecount before passing it to
> kmalloc_array().
>
> Fixes: fbb0de795078 ("Add udmabuf misc device")
> Reported-and-tested-by: syzbot+2c56b725ec547fa9cb29@syzkaller.appspotmail.com
> Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
> ---
>
Gentle ping :)
>
> ---
> drivers/dma-buf/udmabuf.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c
> index c57a609db75b..e7330684d3b8 100644
> --- a/drivers/dma-buf/udmabuf.c
> +++ b/drivers/dma-buf/udmabuf.c
> @@ -190,6 +190,10 @@ static long udmabuf_create(struct miscdevice *device,
> if (ubuf->pagecount > pglimit)
> goto err;
> }
> +
> + if (!ubuf->pagecount)
> + goto err;
> +
> ubuf->pages = kmalloc_array(ubuf->pagecount, sizeof(*ubuf->pages),
> GFP_KERNEL);
> if (!ubuf->pages) {
With regards,
Pavel Skripkin
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH] udmabuf: validate ubuf->pagecount
2022-01-12 18:08 ` Pavel Skripkin
@ 2022-01-14 16:57 ` Daniel Vetter
-1 siblings, 0 replies; 8+ messages in thread
From: Daniel Vetter @ 2022-01-14 16:57 UTC (permalink / raw)
To: Pavel Skripkin
Cc: kraxel, sumit.semwal, christian.koenig, daniel.vetter, dri-devel,
linux-media, linaro-mm-sig, linux-kernel,
syzbot+2c56b725ec547fa9cb29
On Wed, Jan 12, 2022 at 09:08:46PM +0300, Pavel Skripkin wrote:
> On 12/30/21 17:26, Pavel Skripkin wrote:
> > Syzbot has reported GPF in sg_alloc_append_table_from_pages(). The
> > problem was in ubuf->pages == ZERO_PTR.
> >
> > ubuf->pagecount is calculated from arguments passed from user-space. If
> > user creates udmabuf with list.size == 0 then ubuf->pagecount will be
> > also equal to zero; it causes kmalloc_array() to return ZERO_PTR.
> >
> > Fix it by validating ubuf->pagecount before passing it to
> > kmalloc_array().
> >
> > Fixes: fbb0de795078 ("Add udmabuf misc device")
> > Reported-and-tested-by: syzbot+2c56b725ec547fa9cb29@syzkaller.appspotmail.com
> > Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
> > ---
> >
>
> Gentle ping :)
Gerd Hoffmann should pick this one up, pls holler again if it doesn't
happen.
-Daniel
>
> >
> > ---
> > drivers/dma-buf/udmabuf.c | 4 ++++
> > 1 file changed, 4 insertions(+)
> >
> > diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c
> > index c57a609db75b..e7330684d3b8 100644
> > --- a/drivers/dma-buf/udmabuf.c
> > +++ b/drivers/dma-buf/udmabuf.c
> > @@ -190,6 +190,10 @@ static long udmabuf_create(struct miscdevice *device,
> > if (ubuf->pagecount > pglimit)
> > goto err;
> > }
> > +
> > + if (!ubuf->pagecount)
> > + goto err;
> > +
> > ubuf->pages = kmalloc_array(ubuf->pagecount, sizeof(*ubuf->pages),
> > GFP_KERNEL);
> > if (!ubuf->pages) {
>
> With regards,
> Pavel Skripkin
--
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH] udmabuf: validate ubuf->pagecount
@ 2022-01-14 16:57 ` Daniel Vetter
0 siblings, 0 replies; 8+ messages in thread
From: Daniel Vetter @ 2022-01-14 16:57 UTC (permalink / raw)
To: Pavel Skripkin
Cc: daniel.vetter, linux-kernel, dri-devel, linaro-mm-sig, kraxel,
syzbot+2c56b725ec547fa9cb29, christian.koenig, linux-media
On Wed, Jan 12, 2022 at 09:08:46PM +0300, Pavel Skripkin wrote:
> On 12/30/21 17:26, Pavel Skripkin wrote:
> > Syzbot has reported GPF in sg_alloc_append_table_from_pages(). The
> > problem was in ubuf->pages == ZERO_PTR.
> >
> > ubuf->pagecount is calculated from arguments passed from user-space. If
> > user creates udmabuf with list.size == 0 then ubuf->pagecount will be
> > also equal to zero; it causes kmalloc_array() to return ZERO_PTR.
> >
> > Fix it by validating ubuf->pagecount before passing it to
> > kmalloc_array().
> >
> > Fixes: fbb0de795078 ("Add udmabuf misc device")
> > Reported-and-tested-by: syzbot+2c56b725ec547fa9cb29@syzkaller.appspotmail.com
> > Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
> > ---
> >
>
> Gentle ping :)
Gerd Hoffmann should pick this one up, pls holler again if it doesn't
happen.
-Daniel
>
> >
> > ---
> > drivers/dma-buf/udmabuf.c | 4 ++++
> > 1 file changed, 4 insertions(+)
> >
> > diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c
> > index c57a609db75b..e7330684d3b8 100644
> > --- a/drivers/dma-buf/udmabuf.c
> > +++ b/drivers/dma-buf/udmabuf.c
> > @@ -190,6 +190,10 @@ static long udmabuf_create(struct miscdevice *device,
> > if (ubuf->pagecount > pglimit)
> > goto err;
> > }
> > +
> > + if (!ubuf->pagecount)
> > + goto err;
> > +
> > ubuf->pages = kmalloc_array(ubuf->pagecount, sizeof(*ubuf->pages),
> > GFP_KERNEL);
> > if (!ubuf->pages) {
>
> With regards,
> Pavel Skripkin
--
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] udmabuf: validate ubuf->pagecount
2021-12-30 14:26 ` Pavel Skripkin
@ 2022-01-18 6:56 ` Gerd Hoffmann
-1 siblings, 0 replies; 8+ messages in thread
From: Gerd Hoffmann @ 2022-01-18 6:56 UTC (permalink / raw)
To: Pavel Skripkin
Cc: daniel.vetter, linux-kernel, dri-devel, christian.koenig,
linaro-mm-sig, syzbot+2c56b725ec547fa9cb29, linux-media
On Thu, Dec 30, 2021 at 05:26:49PM +0300, Pavel Skripkin wrote:
> Syzbot has reported GPF in sg_alloc_append_table_from_pages(). The
> problem was in ubuf->pages == ZERO_PTR.
>
> ubuf->pagecount is calculated from arguments passed from user-space. If
> user creates udmabuf with list.size == 0 then ubuf->pagecount will be
> also equal to zero; it causes kmalloc_array() to return ZERO_PTR.
>
> Fix it by validating ubuf->pagecount before passing it to
> kmalloc_array().
>
> Fixes: fbb0de795078 ("Add udmabuf misc device")
> Reported-and-tested-by: syzbot+2c56b725ec547fa9cb29@syzkaller.appspotmail.com
> Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
> ---
Pushed to drm-misc-next.
thanks,
Gerd
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH] udmabuf: validate ubuf->pagecount
@ 2022-01-18 6:56 ` Gerd Hoffmann
0 siblings, 0 replies; 8+ messages in thread
From: Gerd Hoffmann @ 2022-01-18 6:56 UTC (permalink / raw)
To: Pavel Skripkin
Cc: sumit.semwal, christian.koenig, daniel.vetter, dri-devel,
linux-media, linaro-mm-sig, linux-kernel,
syzbot+2c56b725ec547fa9cb29
On Thu, Dec 30, 2021 at 05:26:49PM +0300, Pavel Skripkin wrote:
> Syzbot has reported GPF in sg_alloc_append_table_from_pages(). The
> problem was in ubuf->pages == ZERO_PTR.
>
> ubuf->pagecount is calculated from arguments passed from user-space. If
> user creates udmabuf with list.size == 0 then ubuf->pagecount will be
> also equal to zero; it causes kmalloc_array() to return ZERO_PTR.
>
> Fix it by validating ubuf->pagecount before passing it to
> kmalloc_array().
>
> Fixes: fbb0de795078 ("Add udmabuf misc device")
> Reported-and-tested-by: syzbot+2c56b725ec547fa9cb29@syzkaller.appspotmail.com
> Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
> ---
Pushed to drm-misc-next.
thanks,
Gerd
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2022-01-18 6:57 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-12-30 14:26 [PATCH] udmabuf: validate ubuf->pagecount Pavel Skripkin
2021-12-30 14:26 ` Pavel Skripkin
2022-01-12 18:08 ` Pavel Skripkin
2022-01-12 18:08 ` Pavel Skripkin
2022-01-14 16:57 ` Daniel Vetter
2022-01-14 16:57 ` Daniel Vetter
2022-01-18 6:56 ` Gerd Hoffmann
2022-01-18 6:56 ` Gerd Hoffmann
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.