lkml.org 
[lkml]   [2020]   [Jul]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[Linux-kernel-mentees] [PATCH net] qrtr: Fix ZERO_SIZE_PTR deref in qrtr_tun_write_iter()
Date
qrtr_tun_write_iter() is dereferencing `ZERO_SIZE_PTR`s when `from->count`
equals to zero. Fix it by rejecting zero-length kzalloc() requests.

This patch fixes the following syzbot bug:

https://syzkaller.appspot.com/bug?id=f56bbe6668873ee245986bbd23312b895fa5a50a

Reported-by: syzbot+03e343dbccf82a5242a2@syzkaller.appspotmail.com
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
---
net/qrtr/tun.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/net/qrtr/tun.c b/net/qrtr/tun.c
index 15ce9b642b25..5465e94ba8e5 100644
--- a/net/qrtr/tun.c
+++ b/net/qrtr/tun.c
@@ -80,6 +80,9 @@ static ssize_t qrtr_tun_write_iter(struct kiocb *iocb, struct iov_iter *from)
ssize_t ret;
void *kbuf;

+ if (!len)
+ return -EINVAL;
+
kbuf = kzalloc(len, GFP_KERNEL);
if (!kbuf)
return -ENOMEM;
--
2.25.1
\
 
 \ /
  Last update: 2020-07-12 23:05    [W:0.038 / U:0.104 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site