iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers/misc
History
Sabyrzhan Tasbolatov 53f6c858c4 drivers/misc/vmw_vmci: restrict too big queue size in qp_host_alloc_queue 
commit 2fd10bcf0310b9525b2af9e1f7aa9ddd87c3772e upstream.

syzbot found WARNING in qp_broker_alloc[1] in qp_host_alloc_queue()
when num_pages is 0x100001, giving queue_size + queue_page_size
bigger than KMALLOC_MAX_SIZE for kzalloc(), resulting order >= MAX_ORDER
condition.

queue_size + queue_page_size=0x8000d8, where KMALLOC_MAX_SIZE=0x400000.

[1]
Call Trace:
 alloc_pages include/linux/gfp.h:547 [inline]
 kmalloc_order+0x40/0x130 mm/slab_common.c:837
 kmalloc_order_trace+0x15/0x70 mm/slab_common.c:853
 kmalloc_large include/linux/slab.h:481 [inline]
 __kmalloc+0x257/0x330 mm/slub.c:3959
 kmalloc include/linux/slab.h:557 [inline]
 kzalloc include/linux/slab.h:682 [inline]
 qp_host_alloc_queue drivers/misc/vmw_vmci/vmci_queue_pair.c:540 [inline]
 qp_broker_create drivers/misc/vmw_vmci/vmci_queue_pair.c:1351 [inline]
 qp_broker_alloc+0x936/0x2740 drivers/misc/vmw_vmci/vmci_queue_pair.c:1739

Reported-by: syzbot+15ec7391f3d6a1a7cc7d@syzkaller.appspotmail.com
Signed-off-by: Sabyrzhan Tasbolatov <snovitoll@gmail.com>
Link: https://lore.kernel.org/r/20210209102612.2112247-1-snovitoll@gmail.com
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-03-04 11:38:32 +01:00
..
altera-stapl
altera-stapl: altera_get_note: prevent write beyond end of 'key'
2020-03-03 08:02:57 +01:00
c2port
misc: c2port: core: Ensure source size does not equal destination size in strncpy()
2020-06-29 18:45:52 +02:00
cardreader
misc: rtsx: init of rts522a add OCP power off when no card is present
2021-03-04 11:38:32 +01:00
cb710
misc: cb710: sgbuf2: Add missing documentation for cb710_sg_dwiter_write_next_block()'s 'data' arg
2020-06-29 18:45:53 +02:00
cxl
cxl: Rework error message for incompatible slots
2020-08-25 01:31:32 +10:00
echo
char: Replace HTTP links with HTTPS ones
2020-07-23 09:44:15 +02:00
eeprom
misc: eeprom_93xx46: Add module alias to avoid breaking support for non device tree users
2021-03-04 11:38:11 +01:00
genwqe
pci-v5.9-changes
2020-08-07 18:48:15 -07:00
habanalabs
habanalabs: disable FW events on device removal
2021-02-07 15:37:17 +01:00
ibmasm
misc: ibmasm: dot_command: Demote function headers from kerneldoc
2020-07-01 15:08:03 +02:00
lis3lv02d
lis3lv02d: switch to using input device polling mode
2019-10-10 15:24:19 +02:00
lkdtm
lkdtm: don't move ctors to .rodata
2021-02-17 11:02:24 +01:00
mei
mei: hbm: call mei_set_devstate() on hbm stop response
2021-03-04 11:38:12 +01:00
ocxl
powerpc updates for 5.10
2020-10-16 12:21:15 -07:00
sgi-gru
x86/platform/uv: Update Copyrights to conform to HPE standards
2020-10-07 09:10:07 +02:00
sgi-xp
x86/platform/uv: Update Copyrights to conform to HPE standards
2020-10-07 09:10:07 +02:00
ti-st
misc: ti-st: st_kim: Tidy-up bespoke commentry
2020-06-29 18:45:52 +02:00
uacce
Char/Misc driver patches for 5.10-rc1
2020-10-15 10:01:51 -07:00
vmw_vmci
drivers/misc/vmw_vmci: restrict too big queue size in qp_host_alloc_queue
2021-03-04 11:38:32 +01:00
ad525x_dpot-i2c.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 149
2019-05-30 11:25:18 -07:00
ad525x_dpot-spi.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 149
2019-05-30 11:25:18 -07:00
ad525x_dpot.c
docs: misc-devices/pci-endpoint-test.txt: convert to ReST
2020-06-19 14:05:49 -06:00
ad525x_dpot.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 149
2019-05-30 11:25:18 -07:00
apds990x.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 336
2019-06-05 17:37:07 +02:00
apds9802als.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 167
2019-05-30 11:26:39 -07:00
atmel_tclib.c
misc: atmel_tclib: use devm_platform_ioremap_resource() to simplify code
2019-10-10 15:24:19 +02:00
atmel-ssc.c
misc: atmel-ssc: lock with mutex instead of spinlock
2020-06-29 19:10:51 +02:00
bh1770glc.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 336
2019-06-05 17:37:07 +02:00
cs5535-mfgpt.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 206
2019-05-30 11:29:53 -07:00
ds1682.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
dummy-irq.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
enclosure.c
misc: enclosure: Update enclosure_remove_device() documentation to match reality
2020-07-01 15:05:37 +02:00
fastrpc.c
misc: fastrpc: fix incorrect usage of dma_map_sgtable
2021-03-04 11:38:14 +01:00
hisi_hikey_usb.c
misc: hisi_hikey_usb: delete a stray tab
2020-09-22 18:54:00 +02:00
hmc6352.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 167
2019-05-30 11:26:39 -07:00
hpilo.c
misc: hpilo: avoid a useless memset
2020-07-23 12:56:49 +02:00
hpilo.h
hpilo: Replace one-element array with flexible-array member
2020-07-14 18:21:25 +02:00
ibmvmc.c
mm, treewide: rename kzfree() to kfree_sensitive()
2020-08-07 11:33:22 -07:00
ibmvmc.h
misc: Use the correct style for SPDX License Identifier
2019-10-10 15:34:40 +02:00
ics932s401.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156
2019-05-30 11:26:35 -07:00
isl29003.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 61
2019-05-24 17:36:45 +02:00
isl29020.c
misc: isl29020: add missed pm_runtime_disable
2020-01-14 15:06:07 +01:00
Kconfig
misc: mic: remove the MIC drivers
2020-10-28 19:12:03 +01:00
kgdbts.c
kgdbts: switch to kernel_clone()
2020-08-20 13:12:59 +02:00
lattice-ecp3-config.c
misc: lattice-ecp3-config: Remove set but clearly unused variable 'ret'
2020-07-01 15:05:37 +02:00
Makefile
misc: mic: remove the MIC drivers
2020-10-28 19:12:03 +01:00
pch_phub.c
misc: pch_phub: Remove superfluous descriptions to non-existent args 'offset_address'
2020-07-01 15:05:37 +02:00
pci_endpoint_test.c
misc: pci_endpoint_test: fix return value of error branch
2020-12-30 11:53:45 +01:00
phantom.c
misc/phantom.c: use generic power management
2020-06-29 18:43:42 +02:00
pti.c
misc: pti: Remove unparsable empty line in function header
2020-07-01 15:05:36 +02:00
pvpanic.c
misc: pvpanic: Use devm_platform_ioremap_resource()
2020-09-22 18:53:30 +02:00
qcom-coincell.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 284
2019-06-05 17:36:37 +02:00
sram-exec.c
char: Replace HTTP links with HTTPS ones
2020-07-23 09:44:15 +02:00
sram.c
misc: sram: use devm_platform_ioremap_resource_wc()
2019-11-05 18:32:47 +01:00
sram.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
tifm_7xx1.c
misc/tifm_7xx1.c: use generic power management
2020-06-29 18:43:42 +02:00
tifm_core.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
tsl2550.c
misc: tsl2550: remove redundant initialization to variable r
2020-01-14 15:16:51 +01:00
vmw_balloon.c
vmw_balloon: Explicitly include linux/io.h for virt_to_phys()
2019-12-10 10:15:48 +01:00
xilinx_sdfec.c
misc: xilinx-sdfec: convert get_user_pages() --> pin_user_pages()
2020-05-27 11:09:26 +02:00