qjyu
/
OrangePi_CM5
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
OrangePi_CM5/drivers/dma-buf
History
Pavel Skripkin b267a8118c udmabuf: validate ubuf->pagecount 
[ Upstream commit 2b6dd600dd72573c23ea180b5b0b2f1813405882 ]

Syzbot has reported GPF in sg_alloc_append_table_from_pages(). The
problem was in ubuf->pages == ZERO_PTR.

ubuf->pagecount is calculated from arguments passed from user-space. If
user creates udmabuf with list.size == 0 then ubuf->pagecount will be
also equal to zero; it causes kmalloc_array() to return ZERO_PTR.

Fix it by validating ubuf->pagecount before passing it to
kmalloc_array().

Fixes: fbb0de7950 ("Add udmabuf misc device")
Reported-and-tested-by: syzbot+2c56b725ec547fa9cb29@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20211230142649.23022-1-paskripkin@gmail.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 		2022-04-08 14:40:12 +02:00
..
heaps dma-mapping updates for 5.10 2020-10-15 14:43:29 -07:00
Kconfig dma-buf: DMABUF_MOVE_NOTIFY should depend on DMA_SHARED_BUFFER 2021-09-26 14:08:59 +02:00
Makefile dma-buf: Exercise dma-fence-chain under selftests 2020-04-09 19:58:55 +01:00
dma-buf.c dma-buf: WARN on dmabuf release with pending attachments 2021-11-18 14:03:52 +01:00
dma-fence-array.c dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled() 2022-01-27 10:53:43 +01:00
dma-fence-chain.c dma-buf: fence-chain: Document missing dma_fence_chain_init() parameter in kerneldoc 2020-09-03 17:47:02 +05:30
dma-fence.c dma-buf: fix kernel-doc warning in dma-fence.c 2020-09-02 14:39:15 +02:00
dma-heap.c dma-buf: heaps: Fix potential spectre v1 gadget 2022-02-08 18:30:36 +01:00
dma-resv.c dma-buf/dma-resv: Respect num_fences when initializing the shared fence list. 2020-12-30 11:54:26 +01:00
selftest.c dma-buf: Introduce selftesting framework 2019-08-19 18:01:34 +01:00
selftest.h dma-buf: Introduce selftesting framework 2019-08-19 18:01:34 +01:00
selftests.h Merge drm/drm-next into drm-intel-next-queued 2020-06-25 18:05:03 +03:00
seqno-fence.c
…
st-dma-fence-chain.c dma-buf: fix dma-fence-chain out of order test 2020-07-02 15:21:40 +02:00
st-dma-fence.c dmabuf: Mark up onstack timer for selftests 2019-08-20 13:49:15 +01:00
sw_sync.c compat_ioctl: move more drivers to compat_ptr_ioctl 2019-10-23 17:23:44 +02:00
sync_debug.c Linux 5.2-rc5 2019-06-19 12:07:29 +02:00
sync_debug.h
…
sync_file.c dma-buf/sync_file: Don't leak fences on merge failure 2021-07-25 14:36:20 +02:00
sync_trace.h
…
udmabuf.c udmabuf: validate ubuf->pagecount 2022-04-08 14:40:12 +02:00