diff mbox series

[1/2] lib/scatterlist: Fix NULL pointer deference

Message ID 20210309205108.997166-1-ribalda@chromium.org
State Superseded
Headers show
Series [1/2] lib/scatterlist: Fix NULL pointer deference | expand

Commit Message

Ricardo Ribalda March 9, 2021, 8:51 p.m. UTC
When sg_alloc_table_from_pages is called with n_pages = 0, we write in a
non-allocated page. Fix it by checking early the error condition.

[    7.666801] BUG: kernel NULL pointer dereference, address: 0000000000000010
[    7.667487] #PF: supervisor read access in kernel mode
[    7.667970] #PF: error_code(0x0000) - not-present page
[    7.668448] PGD 0 P4D 0
[    7.668690] Oops: 0000 [#1] SMP NOPTI
[    7.669037] CPU: 0 PID: 184 Comm: modprobe Not tainted 5.11.0+ #2
[    7.669606] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
[    7.670378] RIP: 0010:__sg_alloc_table_from_pages+0x2c5/0x4a0
[    7.670924] Code: c9 01 48 c7 40 08 00 00 00 00 48 89 08 8b 47 0c 41 8d 44 00 ff 89 47 0c 48 81 fa 00 f0 ff ff 0f 87 d4 01 00 00 49 8b 16 89 d8 <4a> 8b 74 fd 00 4c 89 d1 44 29 f8 c1 e0 0c 44 29 d8 4c 39 d0 48 0f
[    7.672643] RSP: 0018:ffffba1e8028fb30 EFLAGS: 00010287
[    7.673133] RAX: 0000000000000001 RBX: 0000000000000001 RCX: 0000000000000002
[    7.673791] RDX: 0000000000000002 RSI: ffffffffada6d0ba RDI: ffff9afe01fff820
[    7.674448] RBP: 0000000000000010 R08: 0000000000000001 R09: 0000000000000001
[    7.675100] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[    7.675754] R13: 00000000fffff000 R14: ffff9afe01fff800 R15: 0000000000000000
[    7.676409] FS:  00007fb0f448f540(0000) GS:ffff9afe07a00000(0000) knlGS:0000000000000000
[    7.677151] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    7.677681] CR2: 0000000000000010 CR3: 0000000002184001 CR4: 0000000000370ef0
[    7.678342] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[    7.679019] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[    7.680349] Call Trace:
[    7.680605]  ? device_add+0x146/0x810
[    7.681021]  sg_alloc_table_from_pages+0x11/0x30
[    7.681511]  vb2_dma_sg_alloc+0x162/0x280 [videobuf2_dma_sg]

Cc: stable@vger.kernel.org
Fixes: efc42bc98058 ("scatterlist: add sg_alloc_table_from_pages function")
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
---
 lib/scatterlist.c | 3 +++
 1 file changed, 3 insertions(+)

Comments

Ricardo Ribalda April 6, 2021, 1:31 p.m. UTC | #1
Hi

Friendly ping?

On Tue, Mar 9, 2021 at 9:51 PM Ricardo Ribalda <ribalda@chromium.org> wrote:
>

> When sg_alloc_table_from_pages is called with n_pages = 0, we write in a

> non-allocated page. Fix it by checking early the error condition.

>

> [    7.666801] BUG: kernel NULL pointer dereference, address: 0000000000000010

> [    7.667487] #PF: supervisor read access in kernel mode

> [    7.667970] #PF: error_code(0x0000) - not-present page

> [    7.668448] PGD 0 P4D 0

> [    7.668690] Oops: 0000 [#1] SMP NOPTI

> [    7.669037] CPU: 0 PID: 184 Comm: modprobe Not tainted 5.11.0+ #2

> [    7.669606] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014

> [    7.670378] RIP: 0010:__sg_alloc_table_from_pages+0x2c5/0x4a0

> [    7.670924] Code: c9 01 48 c7 40 08 00 00 00 00 48 89 08 8b 47 0c 41 8d 44 00 ff 89 47 0c 48 81 fa 00 f0 ff ff 0f 87 d4 01 00 00 49 8b 16 89 d8 <4a> 8b 74 fd 00 4c 89 d1 44 29 f8 c1 e0 0c 44 29 d8 4c 39 d0 48 0f

> [    7.672643] RSP: 0018:ffffba1e8028fb30 EFLAGS: 00010287

> [    7.673133] RAX: 0000000000000001 RBX: 0000000000000001 RCX: 0000000000000002

> [    7.673791] RDX: 0000000000000002 RSI: ffffffffada6d0ba RDI: ffff9afe01fff820

> [    7.674448] RBP: 0000000000000010 R08: 0000000000000001 R09: 0000000000000001

> [    7.675100] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000

> [    7.675754] R13: 00000000fffff000 R14: ffff9afe01fff800 R15: 0000000000000000

> [    7.676409] FS:  00007fb0f448f540(0000) GS:ffff9afe07a00000(0000) knlGS:0000000000000000

> [    7.677151] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033

> [    7.677681] CR2: 0000000000000010 CR3: 0000000002184001 CR4: 0000000000370ef0

> [    7.678342] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000

> [    7.679019] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

> [    7.680349] Call Trace:

> [    7.680605]  ? device_add+0x146/0x810

> [    7.681021]  sg_alloc_table_from_pages+0x11/0x30

> [    7.681511]  vb2_dma_sg_alloc+0x162/0x280 [videobuf2_dma_sg]

>

> Cc: stable@vger.kernel.org

> Fixes: efc42bc98058 ("scatterlist: add sg_alloc_table_from_pages function")

> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>

> ---

>  lib/scatterlist.c | 3 +++

>  1 file changed, 3 insertions(+)

>

> diff --git a/lib/scatterlist.c b/lib/scatterlist.c

> index a59778946404..1e83b6a3d930 100644

> --- a/lib/scatterlist.c

> +++ b/lib/scatterlist.c

> @@ -435,6 +435,9 @@ struct scatterlist *__sg_alloc_table_from_pages(struct sg_table *sgt,

>         unsigned int added_nents = 0;

>         struct scatterlist *s = prv;

>

> +       if (n_pages == 0)

> +               return ERR_PTR(-EINVAL);

> +

>         /*

>          * The algorithm below requires max_segment to be aligned to PAGE_SIZE

>          * otherwise it can overshoot.

> --

> 2.30.1.766.gb4fecdf3b7-goog

>



-- 
Ricardo Ribalda
diff mbox series

Patch

diff --git a/lib/scatterlist.c b/lib/scatterlist.c
index a59778946404..1e83b6a3d930 100644
--- a/lib/scatterlist.c
+++ b/lib/scatterlist.c
@@ -435,6 +435,9 @@  struct scatterlist *__sg_alloc_table_from_pages(struct sg_table *sgt,
 	unsigned int added_nents = 0;
 	struct scatterlist *s = prv;
 
+	if (n_pages == 0)
+		return ERR_PTR(-EINVAL);
+
 	/*
 	 * The algorithm below requires max_segment to be aligned to PAGE_SIZE
 	 * otherwise it can overshoot.