linux-kernel - Re: [syzbot] WARNING in __vmalloc_node

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20210511070753.GU1922@kadam>
Date:   Tue, 11 May 2021 10:07:53 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     Pavel Skripkin <paskripkin@...il.com>, mchehab@...nel.org
Cc:     Uladzislau Rezki <urezki@...il.com>, linux-usb@...r.kernel.org,
        linux-media@...r.kernel.org, linux-kernel@...r.kernel.org,
        syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] WARNING in __vmalloc_node_range

On Sat, May 08, 2021 at 03:46:30PM +0300, Dan Carpenter wrote:
> I wrote a Smatch check to see if there were more of these and here are
> the other issues that it found.  (I will expant this check to more types
> on Monday).
> 
> drivers/media/usb/dvb-usb-v2/lmedm04.c:1196 (null)() warn: element count is wrong 'lme2510_props.num_adapters=0' vs 'lme2510_props.adapter=2'

This one is fine, but could do with some cleaning up.

> drivers/media/usb/dvb-usb-v2/af9035.c:1997 (null)() warn: element count is wrong 'af9035_props.num_adapters=0' vs 'af9035_props.adapter=2'
> drivers/media/usb/dvb-usb-v2/af9035.c:2043 (null)() warn: element count is wrong 'it930x_props.num_adapters=0' vs 'it930x_props.adapter=2'
> drivers/media/usb/dvb-usb-v2/af9015.c:1409 (null)() warn: element count is wrong 'af9015_props.num_adapters=0' vs 'af9015_props.adapter=2'

These are false positives because they use the .get_adapter_count()
function instead of setting num_adapters.

> drivers/media/usb/dvb-usb/dtt200u.c:384 (null)() warn: element count is wrong 'wt220u_miglia_properties.num_adapters=1' vs 'wt220u_miglia_properties.adapter=0'

I'm not sure what's going on with this one...  It still looks buggy to
me.

I did re-run Smatch with more elem/count pairs checked and there were
no bugs found.  A bunch of drivers think you need to add a zeroed
element at the end of the .devices[] array so someone could delete that
if they wanted.

drivers/media/usb/dvb-usb/vp702x.c:374 (null)() warn: element count is wrong 'vp702x_properties.num_device_descs=1' vs 'vp702x_properties.devices=2'
drivers/media/usb/dvb-usb/vp7045.c:184 (null)() warn: element count is wrong 'vp7045_properties.num_device_descs=2' vs 'vp7045_properties.devices=3'
drivers/media/usb/dvb-usb/cinergyT2-core.c:206 (null)() warn: element count is wrong 'cinergyt2_properties.num_device_descs=1' vs 'cinergyt2_properties.devices=2'
drivers/media/usb/dvb-usb/digitv.c:300 (null)() warn: element count is wrong 'digitv_properties.num_device_descs=1' vs 'digitv_properties.devices=2'
drivers/media/usb/dvb-usb/dibusb-mc.c:48 (null)() warn: element count is wrong 'dibusb_mc_properties.num_device_descs=8' vs 'dibusb_mc_properties.devices=9'
drivers/media/usb/dvb-usb/pctv452e.c:963 (null)() warn: element count is wrong 'pctv452e_properties.num_device_descs=1' vs 'pctv452e_properties.devices=2'
drivers/media/usb/dvb-usb/pctv452e.c:1015 (null)() warn: element count is wrong 'tt_connect_s2_3600_properties.num_device_descs=2' vs 'tt_connect_s2_3600_properties.devices=3'
drivers/media/usb/dvb-usb/gp8psk.c:324 (null)() warn: element count is wrong 'gp8psk_properties.num_device_descs=4' vs 'gp8psk_properties.devices=5'
drivers/media/usb/dvb-usb/nova-t-usb2.c:168 (null)() warn: element count is wrong 'nova_t_properties.num_device_descs=1' vs 'nova_t_properties.devices=2'
drivers/media/usb/dvb-usb/dibusb-mb.c:267 (null)() warn: element count is wrong 'dibusb1_1_an2235_properties.num_device_descs=2' vs 'dibusb1_1_an2235_properties.devices=3'
drivers/media/usb/dvb-usb/dibusb-mb.c:335 (null)() warn: element count is wrong 'dibusb2_0b_properties.num_device_descs=2' vs 'dibusb2_0b_properties.devices=3'
drivers/media/usb/dvb-usb/dibusb-mb.c:398 (null)() warn: element count is wrong 'artec_t1_usb2_properties.num_device_descs=1' vs 'artec_t1_usb2_properties.devices=2'
drivers/media/usb/dvb-usb/af9005.c:1015 (null)() warn: element count is wrong 'af9005_properties.num_device_descs=3' vs 'af9005_properties.devices=4'
drivers/media/usb/dvb-usb/dtt200u.c:176 (null)() warn: element count is wrong 'dtt200u_properties.num_device_descs=1' vs 'dtt200u_properties.devices=2'
drivers/media/usb/dvb-usb/dtt200u.c:228 (null)() warn: element count is wrong 'wt220u_properties.num_device_descs=1' vs 'wt220u_properties.devices=2'
drivers/media/usb/dvb-usb/dtt200u.c:280 (null)() warn: element count is wrong 'wt220u_fc_properties.num_device_descs=1' vs 'wt220u_fc_properties.devices=2'
drivers/media/usb/dvb-usb/dtt200u.c:332 (null)() warn: element count is wrong 'wt220u_zl0353_properties.num_device_descs=1' vs 'wt220u_zl0353_properties.devices=2'
drivers/media/usb/dvb-usb/dtt200u.c:384 (null)() warn: element count is wrong 'wt220u_miglia_properties.num_device_descs=1' vs 'wt220u_miglia_properties.devices=2'
drivers/media/usb/dvb-usb/az6027.c:1096 (null)() warn: element count is wrong 'az6027_properties.num_device_descs=8' vs 'az6027_properties.devices=9'

regards,
dan carpenter