iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers/misc
History
Sabyrzhan Tasbolatov 3bb93cd8e8 drivers/misc/vmw_vmci: restrict too big queue size in qp_host_alloc_queue 
commit 2fd10bcf0310b9525b2af9e1f7aa9ddd87c3772e upstream.

syzbot found WARNING in qp_broker_alloc[1] in qp_host_alloc_queue()
when num_pages is 0x100001, giving queue_size + queue_page_size
bigger than KMALLOC_MAX_SIZE for kzalloc(), resulting order >= MAX_ORDER
condition.

queue_size + queue_page_size=0x8000d8, where KMALLOC_MAX_SIZE=0x400000.

[1]
Call Trace:
 alloc_pages include/linux/gfp.h:547 [inline]
 kmalloc_order+0x40/0x130 mm/slab_common.c:837
 kmalloc_order_trace+0x15/0x70 mm/slab_common.c:853
 kmalloc_large include/linux/slab.h:481 [inline]
 __kmalloc+0x257/0x330 mm/slub.c:3959
 kmalloc include/linux/slab.h:557 [inline]
 kzalloc include/linux/slab.h:682 [inline]
 qp_host_alloc_queue drivers/misc/vmw_vmci/vmci_queue_pair.c:540 [inline]
 qp_broker_create drivers/misc/vmw_vmci/vmci_queue_pair.c:1351 [inline]
 qp_broker_alloc+0x936/0x2740 drivers/misc/vmw_vmci/vmci_queue_pair.c:1739

Reported-by: syzbot+15ec7391f3d6a1a7cc7d@syzkaller.appspotmail.com
Signed-off-by: Sabyrzhan Tasbolatov <snovitoll@gmail.com>
Link: https://lore.kernel.org/r/20210209102612.2112247-1-snovitoll@gmail.com
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-03-03 17:44:43 +01:00
..
altera-stapl
altera-stapl: altera_get_note: prevent write beyond end of 'key'
2020-04-02 17:20:22 +02:00
c2port
…
cb710
…
cxl
cxl: Fix kobject memleak
2020-08-21 11:02:00 +02:00
echo
misc: echo: Remove unnecessary parentheses and simplify check for zero
2020-04-24 07:59:01 +02:00
eeprom
misc: eeprom_93xx46: Add module alias to avoid breaking support for non device tree users
2021-03-03 17:44:39 +01:00
genwqe
misc: genwqe: should return proper error value.
2019-11-25 09:52:54 +01:00
ibmasm
…
lis3lv02d
…
mei
mei: protect mei_cl_mtu from null dereference
2020-11-18 18:26:28 +01:00
mic
misc: vop: add round_up(x,4) for vring_size to avoid kernel panic
2020-10-29 09:05:43 +01:00
sgi-gru
drivers/misc/sgi-gru: fix Spectre v1 vulnerability
2018-11-27 16:09:41 +01:00
sgi-xp
misc: sgi-xp: Properly initialize buf in xpc_get_rsvd_page_pa
2020-01-29 10:24:25 +01:00
ti-st
misc: ti-st: Fix memory leak in the error path of probe()
2018-09-19 22:47:13 +02:00
vmw_vmci
drivers/misc/vmw_vmci: restrict too big queue size in qp_host_alloc_queue
2021-03-03 17:44:43 +01:00
ad525x_dpot-i2c.c
…
ad525x_dpot-spi.c
…
ad525x_dpot.c
…
ad525x_dpot.h
…
apds990x.c
…
apds9802als.c
…
arm-charlcd.c
…
atmel_tclib.c
…
atmel-ssc.c
misc: atmel-ssc: lock with mutex instead of spinlock
2020-07-22 09:10:54 +02:00
bh1770glc.c
…
cs5535-mfgpt.c
…
ds1682.c
…
dummy-irq.c
…
enclosure.c
scsi: enclosure: Fix stale device oops with hot replug
2020-01-23 08:19:35 +01:00
fsa9480.c
…
hmc6352.c
misc: hmc6352: fix potential Spectre v1
2018-09-26 08:36:35 +02:00
hpilo.c
…
hpilo.h
…
ics932s401.c
…
ioc4.c
…
isl29003.c
…
isl29020.c
…
Kconfig
…
kgdbts.c
misc: kgdbts: Fix restrict error
2019-11-25 09:52:54 +01:00
lattice-ecp3-config.c
…
lkdtm_bugs.c
…
lkdtm_core.c
lkdtm: Add tests for NULL pointer dereference
2019-04-20 09:07:53 +02:00
lkdtm_heap.c
…
lkdtm_perms.c
lkdtm: Add tests for NULL pointer dereference
2019-04-20 09:07:53 +02:00
lkdtm_rodata.c
…
lkdtm_usercopy.c
…
lkdtm.h
lkdtm: Add tests for NULL pointer dereference
2019-04-20 09:07:53 +02:00
Makefile
…
panel.c
…
pch_phub.c
…
phantom.c
…
pti.c
…
qcom-coincell.c
…
spear13xx_pcie_gadget.c
…
sram.c
…
ti_dac7512.c
…
tifm_7xx1.c
…
tifm_core.c
…
tsl2550.c
tsl2550: fix lux1_input error in low light
2018-10-03 17:01:41 -07:00
vexpress-syscfg.c
misc: vexpress: Off by one in vexpress_syscfg_exec()
2019-02-15 08:07:37 +01:00
vmw_balloon.c
vmw_balloon: include asm/io.h
2018-09-29 03:07:35 -07:00