CVE-2021-47649

ubuf->pagecount is calculated from arguments passed from user-space. If user creates udmabuf with list.size == 0 then ubuf->pagecount will be also equal to zero; it causes kmallocarray() to return ZEROPTR.

Fix it by validating ubuf->pagecount before passing it to kmalloc_array().

References

Affected packages

Git /

Affected ranges

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "4.20"
            },
            {
                "fixed": "5.4.189"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "5.5"
            },
            {
                "fixed": "5.10.110"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "5.11"
            },
            {
                "fixed": "5.15.33"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "5.16"
            },
            {
                "fixed": "5.16.19"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "5.17"
            },
            {
                "fixed": "5.17.2"
            }
        ]
    }
]

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-47649.json"