WSL2-Linux-Kernel/drivers/dma-buf
Pavel Skripkin 811b667cef udmabuf: validate ubuf->pagecount
[ Upstream commit 2b6dd600dd ]

Syzbot has reported GPF in sg_alloc_append_table_from_pages(). The
problem was in ubuf->pages == ZERO_PTR.

ubuf->pagecount is calculated from arguments passed from user-space. If
user creates udmabuf with list.size == 0 then ubuf->pagecount will be
also equal to zero; it causes kmalloc_array() to return ZERO_PTR.

Fix it by validating ubuf->pagecount before passing it to
kmalloc_array().

Fixes: fbb0de7950 ("Add udmabuf misc device")
Reported-and-tested-by: syzbot+2c56b725ec547fa9cb29@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20211230142649.23022-1-paskripkin@gmail.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-04-08 14:23:24 +02:00
..
heaps dma-buf: cma_heap: Fix mutex locking section 2022-03-08 19:12:37 +01:00
Kconfig dma-buf: DMABUF_SYSFS_STATS should depend on DMA_SHARED_BUFFER 2021-09-07 12:42:21 +05:30
Makefile dmabuf: Add the capability to expose DMA-BUF stats in sysfs 2021-06-15 11:50:24 +02:00
dma-buf-sysfs-stats.c dma-buf: Delete the DMA-BUF attachment sysfs statistics 2021-07-20 11:06:59 +02:00
dma-buf-sysfs-stats.h dma-buf: Delete the DMA-BUF attachment sysfs statistics 2021-07-20 11:06:59 +02:00
dma-buf.c dma-buf: WARN on dmabuf release with pending attachments 2021-11-18 19:16:08 +01:00
dma-fence-array.c dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled() 2022-01-27 11:02:59 +01:00
dma-fence-chain.c dma-buf: some dma_fence_chain improvements 2021-06-14 19:33:16 +02:00
dma-fence.c drm/syncobj: use newly allocated stub fences 2021-04-08 12:21:13 +02:00
dma-heap.c dma-buf: heaps: Fix potential spectre v1 gadget 2022-02-08 18:34:06 +01:00
dma-resv.c dma-buf: fix dma_resv_test_signaled test_all handling v2 2021-07-08 14:59:08 +02:00
selftest.c dma-buf: Introduce selftesting framework 2019-08-19 18:01:34 +01:00
selftest.h dma-buf: Introduce selftesting framework 2019-08-19 18:01:34 +01:00
selftests.h Merge drm/drm-next into drm-intel-next-queued 2020-06-25 18:05:03 +03:00
seqno-fence.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174 2019-05-30 11:26:41 -07:00
st-dma-fence-chain.c dma-buf: add dma_fence_chain_alloc/free v3 2021-06-14 19:38:34 +02:00
st-dma-fence.c dma-buf: Avoid comma separated statements 2021-02-09 17:14:11 +01:00
sw_sync.c compat_ioctl: move more drivers to compat_ptr_ioctl 2019-10-23 17:23:44 +02:00
sync_debug.c Linux 5.2-rc5 2019-06-19 12:07:29 +02:00
sync_debug.h dma-buf: Remove unused sync_dump() 2019-04-23 09:30:07 +01:00
sync_file.c dma-buf/sync_file: Don't leak fences on merge failure 2021-07-12 13:34:49 +02:00
sync_trace.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
udmabuf.c udmabuf: validate ubuf->pagecount 2022-04-08 14:23:24 +02:00