From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f49.google.com (mail-wr1-f49.google.com [209.85.221.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 26CE6372B4F for ; Wed, 10 Jun 2026 22:39:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.49 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781131178; cv=none; b=VU/dbT5jlZbF81RjIK+utb/LAeJDq7Q+KxE7dHNT4SeTjFMr3+0cL6pau7e84ajU6PFZ4Q1djottTJhFpacz10CpKAGvyRKxF/H2Gb154aFRxSJYrVg5spH9y9XWILznts0iNgg+uMKMEx2dG+CovvGhoJxsdUq4M+5zIDA/SPg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781131178; c=relaxed/simple; bh=Pxyc7m+Vn6/3xVfADGiBL+sZWtIy38qSyiCft+n23Q4=; h=Date:From:To:Subject:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=YzCZOQIJeYgYNx+w6AOECNvTiZLP4VJkGP91UsHa/S4kat0zThKwKeh2v2iNBiF0D/z9yUM9M87/tvNnovcd2VDOManalEXDfuWLZYWpDA6zu/SXR/hTIkKh4jEOjiFFH/t92v+QcuMO/stCsoAslyPRbB2j19I3IExAO3V5l0c= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=YzGfb85y; arc=none smtp.client-ip=209.85.221.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="YzGfb85y" Received: by mail-wr1-f49.google.com with SMTP id ffacd0b85a97d-45eeea039ebso3942518f8f.1 for ; Wed, 10 Jun 2026 15:39:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781131175; x=1781735975; darn=vger.kernel.org; h=mime-version:content-transfer-encoding:references:in-reply-to :message-id:subject:to:from:date:from:to:cc:subject:date:message-id :reply-to; bh=axZRZMWXhEm6Z58qoCAtf5LGLd7rWUy3KiuEC2ZAViw=; b=YzGfb85yxsA0s++iHGwQk5Ai6UklhzWh+uVFKKcdaITT7vjSaBf+odtpn8+ojonECv aBo+hT6Abm3syScRsoa0jbb47Vqk4reLu1Lc5XGRxFV7bSEln0GdxZyIFYNharA6M/Qk KO8HDpjzWnx8io/VpMpw7bGd4UT/o4WQbKO40/i+Keh1THw1A1s8p+Gead0HfRKJ4plw 9ez6sj94ZC0y/iw21P82WEeoN6xL4LcZbj1fYC0Oth6Gjp14Z0BVRaY6eizimXmE7fCx rPoTrC+qNHNOlPygz2XYXHI3zGkzuT38MSJpj3XOyE8ecxD9YA6UrvujQTNRl9b/m9el 7KjA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781131175; x=1781735975; h=mime-version:content-transfer-encoding:references:in-reply-to :message-id:subject:to:from:date:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=axZRZMWXhEm6Z58qoCAtf5LGLd7rWUy3KiuEC2ZAViw=; b=oU81Yqfb5Fi/7g3RtPxLKCYEwN20X6+HiZMwSP+b0v9Iz34LDSiwJpNkidMBs3eYlE O3jlxPytwZVj77mUMNha7SGRQ0cjRzYVkGghZ+OUwlbJTqM3MGPPIUtSDR5ZxiFLK67R /UWHBsmP2wcyBOu2eTj0PYQm6YNYCo2TS5Liv6dv/dZtwWagWSE/s++d83PaiLl0uyqS wPEbiQ037zJlsoUELmT1hS0jV7ISccECRw5fe15Zm3wHUGcDml19uFWWAP0njwrL11yS O7GoI96obOxY1SDojP4iA9ffP+IfwnzFznKc6h3Gkd7pInUhLMP8p+Dfm2v/Byz3yp6w AUYw== X-Forwarded-Encrypted: i=1; AFNElJ8ytuQZ65l/9JVnIF5bp9P8vudSJHqTbS26dXwAcAUc9mQg/TZK3P0ZkVB/PXfkPwdnYPBTGzRUURADIf4=@vger.kernel.org X-Gm-Message-State: AOJu0YzPawsohDUm1J693e5ETA/Y6oyr3d9Pnio0Voop4BuERc0aIoIC oydXBQHZ1GTJeUhyqmCJ4mZQtwsYGp+TZoF76uaiX+rs7g38TRSQiMebSF+119HF X-Gm-Gg: Acq92OHI8jutnN1koOWvbHj3iwPoMBS2h14nYzitOWl5q81Pr2SjeHsRVcLLzmXYuh3 Z1dbteI3d7ZO5zngIjkSsLLjNDNaU+8Ivz/RcoMHwNNP1XsdHAijmB9nU5WyQc5Fzv/SOzySO7x rVyAHxowMu9snx5rfExGAATfPVgXEVGSjRW1DkUpCFab6XUo8AejnmsdFF4dIwmrSa9Hxlsbca4 +lo8ax1vP1x27VSHZuFMbDZkdwMnSGhbsKUtGKYp+iqNoY/nCXXq509cZUZHLmN95HkXhVEnK59 kZXxSdUGcD6lWHgR+cBKHcpqKqeIuwnx5UtGyS1gZ0l/NYv7eVA+DVQUOuFbgMdpETCCBGieHB5 bbeeLdjnyQu8YYUg7AN+UqxABWrjV2Ol9wqbohnrDzcP3MEch2dG0FdxfdGJZ51TVgkP/69XRNL 6kNDl1EqEk8a6onD/kvH6/pCGqgpBPM1wZs4ZxGlGqbPpZnA== X-Received: by 2002:a05:6000:299b:20b0:460:1967:abed with SMTP id ffacd0b85a97d-460677c2ddemr145895f8f.39.1781131175509; Wed, 10 Jun 2026 15:39:35 -0700 (PDT) Received: from [127.0.0.1] ([141.255.129.1]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-4601f360bd6sm81616932f8f.36.2026.06.10.15.39.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 10 Jun 2026 15:39:35 -0700 (PDT) Date: Wed, 10 Jun 2026 15:39:35 -0700 (PDT) From: Charles Pellegrini To: akpm@linux-foundation.org, egorenar-dev@posteo.net, robert.jarzmik@free.fr, t-pratham@ti.com, david@davidgow.net, linux-kernel@vger.kernel.org Subject: [PATCH v2 4/5] lib: scatterlist: guard sg_split_phys()/sg_split_mapped() against zero-nents splits Message-ID: <178113124324.90620.1158417223990002175@gmail.com> In-Reply-To: <178113124323.90620.6403136846887207198@gmail.com> References: <178027099087.72481.1976843064458686851@gmail.com> <178113124323.90620.6403136846887207198@gmail.com> Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 If a caller passes a split_sizes[] array whose trailing entry is 0 and the preceding splits exactly consume the input scatterlist, sg_calculate_split() returns success with the trailing split's nents left at 0. sg_split() then allocates that split's output with kmalloc_objs(struct scatterlist, 0, gfp_mask) which returns ZERO_SIZE_PTR. Both copiers finish each split with a fixup of the last written output entry -- sg_split_phys() does out_sg[-1].length = split->length_last_sg; sg_mark_end(out_sg - 1); and sg_split_mapped() does sg_dma_len(--out_sg) = split->length_last_sg; For a zero-nents split out_sg has not advanced, so that fixup dereferences ZERO_SIZE_PTR: an out-of-bounds write. KASAN reports it as a slab out-of-bounds write; a userspace ASAN harness reproduces it as a heap overflow. Skip empty splits at the top of the per-split loop in both copiers: if (!split->nents) continue; No in-tree caller passes such a split_sizes[] array, so this is latent; it was surfaced by an automated review of the v1 posting. The fix tolerates and skips the degenerate split rather than rejecting it with -EINVAL in sg_calculate_split(); if a stricter contract is preferred, the rejecting variant is a trivial respin. Fixes: f8bcbe62acd0 ("lib: scatterlist: add sg splitting function") Link: https://lore.kernel.org/all/20260601175549.b4a10c07dd9e3b867f66da0c@linux-foundation.org/ Assisted-by: Claude:claude-opus-4-8 hegel-c Signed-off-by: Charles Pellegrini --- lib/sg_split.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lib/sg_split.c b/lib/sg_split.c index ab574dd26b03..e90a1bfbdb56 100644 --- a/lib/sg_split.c +++ b/lib/sg_split.c @@ -81,6 +81,8 @@ static void sg_split_phys(struct sg_splitter *splitters, const int nb_splits) struct sg_splitter *split; for (i = 0, split = splitters; i < nb_splits; i++, split++) { + if (!split->nents) + continue; in_sg = split->in_sg0; out_sg = split->out_sg; for (j = 0; j < split->nents; j++, out_sg++) { @@ -108,6 +110,8 @@ static void sg_split_mapped(struct sg_splitter *splitters, const int nb_splits) struct sg_splitter *split; for (i = 0, split = splitters; i < nb_splits; i++, split++) { + if (!split->nents) + continue; in_sg = split->in_sg0; out_sg = split->out_sg; for (j = 0; j < split->nents; j++, out_sg++) { -- 2.47.3