On 10/13/21 19:51, syzbot wrote:

Hello,

syzbot found the following issue on:

HEAD commit: 717478d89fe2 Merge tag 'riscv-for-linus-5.15-rc5' of git:/.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=12489abf300000 kernel config: https://syzkaller.appspot.com/x/.config?x=32e6048063923b7b dashboard link: https://syzkaller.appspot.com/bug?extid=2c56b725ec547fa9cb29 compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=167b9e4f300000

The issue was bisected to:

commit 284562e1f34874e267d4f499362c3816f8f6bc3f Author: Gurchetan Singh gurchetansingh@chromium.org Date: Tue Dec 3 01:36:27 2019 +0000

 udmabuf: implement begin_cpu_access/end_cpu_access hooks

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=12d68447300000 final oops: https://syzkaller.appspot.com/x/report.txt?x=11d68447300000 console output: https://syzkaller.appspot.com/x/log.txt?x=16d68447300000

zero ubuf->pagecount will cause kmalloc_array() to return ZERO_PTR, that is unsafe to deref

#syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

With regards, Pavel Skripkin