Kernel/linux-next
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git synced 2025-01-09 15:29:16 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
linux-next/net/qrtr
History
Sabyrzhan Tasbolatov 2a80c15812 net/qrtr: restrict user-controlled length in qrtr_tun_write_iter() 
syzbot found WARNING in qrtr_tun_write_iter [1] when write_iter length
exceeds KMALLOC_MAX_SIZE causing order >= MAX_ORDER condition.

Additionally, there is no check for 0 length write.

[1]
WARNING: mm/page_alloc.c:5011
[..]
Call Trace:
 alloc_pages_current+0x18c/0x2a0 mm/mempolicy.c:2267
 alloc_pages include/linux/gfp.h:547 [inline]
 kmalloc_order+0x2e/0xb0 mm/slab_common.c:837
 kmalloc_order_trace+0x14/0x120 mm/slab_common.c:853
 kmalloc include/linux/slab.h:557 [inline]
 kzalloc include/linux/slab.h:682 [inline]
 qrtr_tun_write_iter+0x8a/0x180 net/qrtr/tun.c:83
 call_write_iter include/linux/fs.h:1901 [inline]

Reported-by: syzbot+c2a7e5c5211605a90865@syzkaller.appspotmail.com
Signed-off-by: Sabyrzhan Tasbolatov <snovitoll@gmail.com>
Link: https://lore.kernel.org/r/20210202092059.1361381-1-snovitoll@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-02-03 16:29:06 -08:00
..
Kconfig
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
Makefile
net: qrtr: Add MHI transport layer
2020-05-07 13:21:12 -07:00
mhi.c
net: qrtr: Unprepare MHI channels during remove
2020-11-20 11:55:17 +05:30
ns.c
net: qrtr: fix null-ptr-deref in qrtr_ns_remove
2021-01-05 16:50:09 -08:00
qrtr.c
net: qrtr: fix null-ptr-deref in qrtr_ns_remove
2021-01-05 16:50:09 -08:00
qrtr.h
net: qrtr: fix null-ptr-deref in qrtr_ns_remove
2021-01-05 16:50:09 -08:00
smd.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 284
2019-06-05 17:36:37 +02:00
tun.c
net/qrtr: restrict user-controlled length in qrtr_tun_write_iter()
2021-02-03 16:29:06 -08:00