From: Dmitry Vyukov <dvyukov@google.com>
To: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Uladzislau Rezki <urezki@gmail.com>,
USB list <linux-usb@vger.kernel.org>,
Linux Media Mailing List <linux-media@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
Mauro Carvalho Chehab <mchehab@kernel.org>,
syzkaller-bugs <syzkaller-bugs@googlegroups.com>
Subject: Re: [syzbot] WARNING in __vmalloc_node_range
Date: Thu, 6 May 2021 17:00:41 +0200 [thread overview]
Message-ID: <CACT4Y+bEpri=MaveEOSeGGa3i-hwVgt3Cq13GMQxPLWu7g+ThA@mail.gmail.com> (raw)
In-Reply-To: <20210506145722.GC1955@kadam>
On Thu, May 6, 2021 at 4:57 PM Dan Carpenter <dan.carpenter@oracle.com> wrote:
>
> On Thu, May 06, 2021 at 04:22:10PM +0200, Uladzislau Rezki wrote:
> > Seems like vmalloc() is called with zero size passed:
> >
> > <snip>
> > void *__vmalloc_node_range(unsigned long size, unsigned long align,
> > unsigned long start, unsigned long end, gfp_t gfp_mask,
> > pgprot_t prot, unsigned long vm_flags, int node,
> > const void *caller)
> > {
> > struct vm_struct *area;
> > void *addr;
> > unsigned long real_size = size;
> > unsigned long real_align = align;
> > unsigned int shift = PAGE_SHIFT;
> >
> > 2873 if (WARN_ON_ONCE(!size))
> > return NULL;
> > <snip>
> >
> > from the dvb_dmx_init() driver:
> >
> > <snip>
> > int dvb_dmx_init(struct dvb_demux *dvbdemux)
> > {
> > int i;
> > struct dmx_demux *dmx = &dvbdemux->dmx;
> >
> > dvbdemux->cnt_storage = NULL;
> > dvbdemux->users = 0;
> > 1251 dvbdemux->filter = vmalloc(array_size(sizeof(struct dvb_demux_filter),
> > <snip> dvbdemux->filternum));
>
> Indeed.
>
> It is a mystery because array_size() should never return less than
> sizeof(struct dvb_demux_filter). That's the whole point of the
> array_size() function is that it returns ULONG_MAX if there is an
> integer overflow.
But it will return 0 if dvbdemux->filternum==0, right?
next prev parent reply other threads:[~2021-05-06 15:00 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-06 10:33 [syzbot] WARNING in __vmalloc_node_range syzbot
2021-05-06 14:22 ` Uladzislau Rezki
2021-05-06 14:57 ` Dan Carpenter
2021-05-06 15:00 ` Dmitry Vyukov [this message]
2021-05-06 15:06 ` Dan Carpenter
2021-05-06 15:00 ` Pavel Skripkin
2021-05-07 8:04 ` Dan Carpenter
2021-05-07 12:29 ` Pavel Skripkin
2021-05-07 12:42 ` Uladzislau Rezki
2021-05-07 12:45 ` Pavel Skripkin
2021-05-08 12:46 ` Dan Carpenter
2021-05-11 7:07 ` Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CACT4Y+bEpri=MaveEOSeGGa3i-hwVgt3Cq13GMQxPLWu7g+ThA@mail.gmail.com' \
--to=dvyukov@google.com \
--cc=dan.carpenter@oracle.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=mchehab@kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=urezki@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.