AcoSail/kernel_optimize_test
8
0
Fork 0
forked from luck/tmp_suning_uos_patched
Code Pull Requests Activity
c92bd51313
kernel_optimize_test/drivers/dma-buf
History
Pavel Skripkin b267a8118c udmabuf: validate ubuf->pagecount 
[ Upstream commit 2b6dd600dd72573c23ea180b5b0b2f1813405882 ]

Syzbot has reported GPF in sg_alloc_append_table_from_pages(). The
problem was in ubuf->pages == ZERO_PTR.

ubuf->pagecount is calculated from arguments passed from user-space. If
user creates udmabuf with list.size == 0 then ubuf->pagecount will be
also equal to zero; it causes kmalloc_array() to return ZERO_PTR.

Fix it by validating ubuf->pagecount before passing it to
kmalloc_array().

Fixes: fbb0de7950 ("Add udmabuf misc device")
Reported-and-tested-by: syzbot+2c56b725ec547fa9cb29@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20211230142649.23022-1-paskripkin@gmail.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-04-08 14:40:12 +02:00
..
heaps dma-mapping updates for 5.10 2020-10-15 14:43:29 -07:00
dma-buf.c dma-buf: WARN on dmabuf release with pending attachments 2021-11-18 14:03:52 +01:00
dma-fence-array.c dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled() 2022-01-27 10:53:43 +01:00
dma-fence-chain.c dma-buf: fence-chain: Document missing dma_fence_chain_init() parameter in kerneldoc 2020-09-03 17:47:02 +05:30
dma-fence.c dma-buf: fix kernel-doc warning in dma-fence.c 2020-09-02 14:39:15 +02:00
dma-heap.c dma-buf: heaps: Fix potential spectre v1 gadget 2022-02-08 18:30:36 +01:00
dma-resv.c dma-buf/dma-resv: Respect num_fences when initializing the shared fence list. 2020-12-30 11:54:26 +01:00
Kconfig dma-buf: DMABUF_MOVE_NOTIFY should depend on DMA_SHARED_BUFFER 2021-09-26 14:08:59 +02:00
Makefile dma-buf: Exercise dma-fence-chain under selftests 2020-04-09 19:58:55 +01:00
selftest.c
selftest.h
selftests.h Merge drm/drm-next into drm-intel-next-queued 2020-06-25 18:05:03 +03:00
seqno-fence.c
st-dma-fence-chain.c dma-buf: fix dma-fence-chain out of order test 2020-07-02 15:21:40 +02:00
st-dma-fence.c
sw_sync.c
sync_debug.c
sync_debug.h
sync_file.c dma-buf/sync_file: Don't leak fences on merge failure 2021-07-25 14:36:20 +02:00
sync_trace.h
udmabuf.c udmabuf: validate ubuf->pagecount 2022-04-08 14:40:12 +02:00