On 10/13/21 19:51, syzbot wrote:
Hello,
syzbot found the following issue on:
HEAD commit: 717478d89fe2 Merge tag 'riscv-for-linus-5.15-rc5' of git:/.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=12489abf300000 kernel config: https://syzkaller.appspot.com/x/.config?x=32e6048063923b7b dashboard link: https://syzkaller.appspot.com/bug?extid=2c56b725ec547fa9cb29 compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=167b9e4f300000
The issue was bisected to:
commit 284562e1f34874e267d4f499362c3816f8f6bc3f Author: Gurchetan Singh gurchetansingh@chromium.org Date: Tue Dec 3 01:36:27 2019 +0000
udmabuf: implement begin_cpu_access/end_cpu_access hooks
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=12d68447300000 final oops: https://syzkaller.appspot.com/x/report.txt?x=11d68447300000 console output: https://syzkaller.appspot.com/x/log.txt?x=16d68447300000
zero ubuf->pagecount will cause kmalloc_array() to return ZERO_PTR, that is unsafe to deref
#syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
With regards, Pavel Skripkin
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+2c56b725ec547fa9cb29@syzkaller.appspotmail.com
Tested on:
commit: eec4df26 Merge tag 's390-5.16-6' of git://git.kernel.o.. git tree: upstream kernel config: https://syzkaller.appspot.com/x/.config?x=1bce7595e2f1eaf8 dashboard link: https://syzkaller.appspot.com/bug?extid=2c56b725ec547fa9cb29 compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 patch: https://syzkaller.appspot.com/x/patch.diff?x=14fe2f47b00000
Note: testing is done by a robot and is best-effort only.
linaro-mm-sig@lists.linaro.org