* [PATCH 1/2] lib/scatterlist: Fix NULL pointer deference
@ 2021-03-09 20:51 Ricardo Ribalda
2021-03-09 20:51 ` [PATCH 2/2] media: videobuf2: Exit promptly if size = 0 Ricardo Ribalda
2021-04-06 13:31 ` [PATCH 1/2] lib/scatterlist: Fix NULL pointer deference Ricardo Ribalda
0 siblings, 2 replies; 3+ messages in thread
From: Ricardo Ribalda @ 2021-03-09 20:51 UTC (permalink / raw)
To: Tomasz Figa, Marek Szyprowski, Mauro Carvalho Chehab,
Daniel Vetter, linux-media, linux-kernel
Cc: Ricardo Ribalda, stable
When sg_alloc_table_from_pages is called with n_pages = 0, we write in a
non-allocated page. Fix it by checking early the error condition.
[ 7.666801] BUG: kernel NULL pointer dereference, address: 0000000000000010
[ 7.667487] #PF: supervisor read access in kernel mode
[ 7.667970] #PF: error_code(0x0000) - not-present page
[ 7.668448] PGD 0 P4D 0
[ 7.668690] Oops: 0000 [#1] SMP NOPTI
[ 7.669037] CPU: 0 PID: 184 Comm: modprobe Not tainted 5.11.0+ #2
[ 7.669606] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
[ 7.670378] RIP: 0010:__sg_alloc_table_from_pages+0x2c5/0x4a0
[ 7.670924] Code: c9 01 48 c7 40 08 00 00 00 00 48 89 08 8b 47 0c 41 8d 44 00 ff 89 47 0c 48 81 fa 00 f0 ff ff 0f 87 d4 01 00 00 49 8b 16 89 d8 <4a> 8b 74 fd 00 4c 89 d1 44 29 f8 c1 e0 0c 44 29 d8 4c 39 d0 48 0f
[ 7.672643] RSP: 0018:ffffba1e8028fb30 EFLAGS: 00010287
[ 7.673133] RAX: 0000000000000001 RBX: 0000000000000001 RCX: 0000000000000002
[ 7.673791] RDX: 0000000000000002 RSI: ffffffffada6d0ba RDI: ffff9afe01fff820
[ 7.674448] RBP: 0000000000000010 R08: 0000000000000001 R09: 0000000000000001
[ 7.675100] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[ 7.675754] R13: 00000000fffff000 R14: ffff9afe01fff800 R15: 0000000000000000
[ 7.676409] FS: 00007fb0f448f540(0000) GS:ffff9afe07a00000(0000) knlGS:0000000000000000
[ 7.677151] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 7.677681] CR2: 0000000000000010 CR3: 0000000002184001 CR4: 0000000000370ef0
[ 7.678342] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 7.679019] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 7.680349] Call Trace:
[ 7.680605] ? device_add+0x146/0x810
[ 7.681021] sg_alloc_table_from_pages+0x11/0x30
[ 7.681511] vb2_dma_sg_alloc+0x162/0x280 [videobuf2_dma_sg]
Cc: stable@vger.kernel.org
Fixes: efc42bc98058 ("scatterlist: add sg_alloc_table_from_pages function")
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
---
lib/scatterlist.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/lib/scatterlist.c b/lib/scatterlist.c
index a59778946404..1e83b6a3d930 100644
--- a/lib/scatterlist.c
+++ b/lib/scatterlist.c
@@ -435,6 +435,9 @@ struct scatterlist *__sg_alloc_table_from_pages(struct sg_table *sgt,
unsigned int added_nents = 0;
struct scatterlist *s = prv;
+ if (n_pages == 0)
+ return ERR_PTR(-EINVAL);
+
/*
* The algorithm below requires max_segment to be aligned to PAGE_SIZE
* otherwise it can overshoot.
--
2.30.1.766.gb4fecdf3b7-goog
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH 2/2] media: videobuf2: Exit promptly if size = 0
2021-03-09 20:51 [PATCH 1/2] lib/scatterlist: Fix NULL pointer deference Ricardo Ribalda
@ 2021-03-09 20:51 ` Ricardo Ribalda
2021-04-06 13:31 ` [PATCH 1/2] lib/scatterlist: Fix NULL pointer deference Ricardo Ribalda
1 sibling, 0 replies; 3+ messages in thread
From: Ricardo Ribalda @ 2021-03-09 20:51 UTC (permalink / raw)
To: Tomasz Figa, Marek Szyprowski, Mauro Carvalho Chehab,
Daniel Vetter, linux-media, linux-kernel
Cc: Ricardo Ribalda
Exit as soon as possible if a driver wants to allocate a buffer of
size 0, and print a warning to help fixing the issue.
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
---
drivers/media/common/videobuf2/videobuf2-dma-sg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/common/videobuf2/videobuf2-dma-sg.c b/drivers/media/common/videobuf2/videobuf2-dma-sg.c
index 030e48218687..c5b06a509566 100644
--- a/drivers/media/common/videobuf2/videobuf2-dma-sg.c
+++ b/drivers/media/common/videobuf2/videobuf2-dma-sg.c
@@ -105,7 +105,7 @@ static void *vb2_dma_sg_alloc(struct device *dev, unsigned long dma_attrs,
int ret;
int num_pages;
- if (WARN_ON(!dev))
+ if (WARN_ON(!dev) || WARN_ON(!size))
return ERR_PTR(-EINVAL);
buf = kzalloc(sizeof *buf, GFP_KERNEL);
--
2.30.1.766.gb4fecdf3b7-goog
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH 1/2] lib/scatterlist: Fix NULL pointer deference
2021-03-09 20:51 [PATCH 1/2] lib/scatterlist: Fix NULL pointer deference Ricardo Ribalda
2021-03-09 20:51 ` [PATCH 2/2] media: videobuf2: Exit promptly if size = 0 Ricardo Ribalda
@ 2021-04-06 13:31 ` Ricardo Ribalda
1 sibling, 0 replies; 3+ messages in thread
From: Ricardo Ribalda @ 2021-04-06 13:31 UTC (permalink / raw)
To: Tomasz Figa, Marek Szyprowski, Mauro Carvalho Chehab,
Daniel Vetter, Linux Media Mailing List,
Linux Kernel Mailing List
Cc: stable
Hi
Friendly ping?
On Tue, Mar 9, 2021 at 9:51 PM Ricardo Ribalda <ribalda@chromium.org> wrote:
>
> When sg_alloc_table_from_pages is called with n_pages = 0, we write in a
> non-allocated page. Fix it by checking early the error condition.
>
> [ 7.666801] BUG: kernel NULL pointer dereference, address: 0000000000000010
> [ 7.667487] #PF: supervisor read access in kernel mode
> [ 7.667970] #PF: error_code(0x0000) - not-present page
> [ 7.668448] PGD 0 P4D 0
> [ 7.668690] Oops: 0000 [#1] SMP NOPTI
> [ 7.669037] CPU: 0 PID: 184 Comm: modprobe Not tainted 5.11.0+ #2
> [ 7.669606] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
> [ 7.670378] RIP: 0010:__sg_alloc_table_from_pages+0x2c5/0x4a0
> [ 7.670924] Code: c9 01 48 c7 40 08 00 00 00 00 48 89 08 8b 47 0c 41 8d 44 00 ff 89 47 0c 48 81 fa 00 f0 ff ff 0f 87 d4 01 00 00 49 8b 16 89 d8 <4a> 8b 74 fd 00 4c 89 d1 44 29 f8 c1 e0 0c 44 29 d8 4c 39 d0 48 0f
> [ 7.672643] RSP: 0018:ffffba1e8028fb30 EFLAGS: 00010287
> [ 7.673133] RAX: 0000000000000001 RBX: 0000000000000001 RCX: 0000000000000002
> [ 7.673791] RDX: 0000000000000002 RSI: ffffffffada6d0ba RDI: ffff9afe01fff820
> [ 7.674448] RBP: 0000000000000010 R08: 0000000000000001 R09: 0000000000000001
> [ 7.675100] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
> [ 7.675754] R13: 00000000fffff000 R14: ffff9afe01fff800 R15: 0000000000000000
> [ 7.676409] FS: 00007fb0f448f540(0000) GS:ffff9afe07a00000(0000) knlGS:0000000000000000
> [ 7.677151] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 7.677681] CR2: 0000000000000010 CR3: 0000000002184001 CR4: 0000000000370ef0
> [ 7.678342] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [ 7.679019] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [ 7.680349] Call Trace:
> [ 7.680605] ? device_add+0x146/0x810
> [ 7.681021] sg_alloc_table_from_pages+0x11/0x30
> [ 7.681511] vb2_dma_sg_alloc+0x162/0x280 [videobuf2_dma_sg]
>
> Cc: stable@vger.kernel.org
> Fixes: efc42bc98058 ("scatterlist: add sg_alloc_table_from_pages function")
> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
> ---
> lib/scatterlist.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/lib/scatterlist.c b/lib/scatterlist.c
> index a59778946404..1e83b6a3d930 100644
> --- a/lib/scatterlist.c
> +++ b/lib/scatterlist.c
> @@ -435,6 +435,9 @@ struct scatterlist *__sg_alloc_table_from_pages(struct sg_table *sgt,
> unsigned int added_nents = 0;
> struct scatterlist *s = prv;
>
> + if (n_pages == 0)
> + return ERR_PTR(-EINVAL);
> +
> /*
> * The algorithm below requires max_segment to be aligned to PAGE_SIZE
> * otherwise it can overshoot.
> --
> 2.30.1.766.gb4fecdf3b7-goog
>
--
Ricardo Ribalda
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-04-06 13:31 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-03-09 20:51 [PATCH 1/2] lib/scatterlist: Fix NULL pointer deference Ricardo Ribalda
2021-03-09 20:51 ` [PATCH 2/2] media: videobuf2: Exit promptly if size = 0 Ricardo Ribalda
2021-04-06 13:31 ` [PATCH 1/2] lib/scatterlist: Fix NULL pointer deference Ricardo Ribalda
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).