Messages in this thread | | | Date | Tue, 18 Jan 2022 07:56:50 +0100 | From | Gerd Hoffmann <> | Subject | Re: [PATCH] udmabuf: validate ubuf->pagecount |
| |
On Thu, Dec 30, 2021 at 05:26:49PM +0300, Pavel Skripkin wrote: > Syzbot has reported GPF in sg_alloc_append_table_from_pages(). The > problem was in ubuf->pages == ZERO_PTR. > > ubuf->pagecount is calculated from arguments passed from user-space. If > user creates udmabuf with list.size == 0 then ubuf->pagecount will be > also equal to zero; it causes kmalloc_array() to return ZERO_PTR. > > Fix it by validating ubuf->pagecount before passing it to > kmalloc_array(). > > Fixes: fbb0de795078 ("Add udmabuf misc device") > Reported-and-tested-by: syzbot+2c56b725ec547fa9cb29@syzkaller.appspotmail.com > Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> > ---
Pushed to drm-misc-next.
thanks, Gerd
| |