From: Pavel Skripkin <paskripkin@gmail.com>
To: syzbot <syzbot+5c943fe38e86d615cac2@syzkaller.appspotmail.com>,
christian.koenig@amd.com, daniel.vetter@ffwll.ch,
dri-devel@lists.freedesktop.org, gustavo@padovan.org,
linaro-mm-sig@lists.linaro.org, linux-kernel@vger.kernel.org,
linux-media@vger.kernel.org, sumit.semwal@linaro.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] general protection fault in dma_fence_array_first
Date: Wed, 30 Mar 2022 01:02:36 +0300 [thread overview]
Message-ID: <419a9bb8-cb68-8add-e7be-275a48b2126d@gmail.com> (raw)
In-Reply-To: <0000000000008eedfe05db620952@google.com>
[-- Attachment #1: Type: text/plain, Size: 1181 bytes --]
On 3/30/22 00:23, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 8515d05bf6bc Add linux-next specific files for 20220328
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=1694e21b700000
> kernel config: https://syzkaller.appspot.com/x/.config?x=530c68bef4e2b8a8
> dashboard link: https://syzkaller.appspot.com/bug?extid=5c943fe38e86d615cac2
> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1467313b700000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=121b7cb9700000
>
> The issue was bisected to:
>
> commit 519f490db07e1a539490612f376487f61e48e39c
> Author: Christian König <christian.koenig@amd.com>
> Date: Fri Mar 11 09:32:26 2022 +0000
>
> dma-buf/sync-file: fix warning about fence containers
>
There is ZERO_PTR dereference caused by passing 0 to krealloc_array().
Code should not try to reduce allocated memory area if index is equal to 0
#syz test:
git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
With regards,
Pavel Skripkin
[-- Attachment #2: ph --]
[-- Type: text/plain, Size: 500 bytes --]
diff --git a/drivers/dma-buf/sync_file.c b/drivers/dma-buf/sync_file.c
index b8dea4ec123b..60cb4266e77f 100644
--- a/drivers/dma-buf/sync_file.c
+++ b/drivers/dma-buf/sync_file.c
@@ -264,7 +264,7 @@ static struct sync_file *sync_file_merge(const char *name, struct sync_file *a,
if (index == 0)
add_fence(fences, &index, dma_fence_get_stub());
- if (num_fences > index) {
+ if (index && num_fences > index) {
struct dma_fence **tmp;
/* Keep going even when reducing the size failed */
next prev parent reply other threads:[~2022-03-29 22:02 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-29 21:23 [syzbot] general protection fault in dma_fence_array_first syzbot
2022-03-29 22:02 ` Pavel Skripkin [this message]
2022-03-29 22:12 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=419a9bb8-cb68-8add-e7be-275a48b2126d@gmail.com \
--to=paskripkin@gmail.com \
--cc=christian.koenig@amd.com \
--cc=daniel.vetter@ffwll.ch \
--cc=dri-devel@lists.freedesktop.org \
--cc=gustavo@padovan.org \
--cc=linaro-mm-sig@lists.linaro.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=sumit.semwal@linaro.org \
--cc=syzbot+5c943fe38e86d615cac2@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.