Subject: Re: [syzbot] WARNING: zero-size vmalloc in corrupted

From: Pavel Skripkin <[email-masked]>
Date: Wed, 23 Jun 2021 19:19:28 +0300

On Wed, 23 Jun 2021 02:15:23 -0700
syzbot <[email-masked]> wrote:

> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    13311e74 Linux 5.13-rc7
> git tree:       upstream
> console output:
> https://syzkaller.appspot.com/x/log.txt?x=15d01e58300000 kernel
> config:  https://syzkaller.appspot.com/x/.config?x=42ecca11b759d96c
> dashboard link:
> https://syzkaller.appspot.com/bug?extid=c2f6f09fe907a838effb syz
> repro:
> https://syzkaller.appspot.com/x/repro.syz?x=14bb89e8300000 C
> reproducer:   https://syzkaller.appspot.com/x/repro.c?x=17cc51b8300000
> 
> The issue was bisected to:
> 
> commit f9006acc8dfe59e25aa75729728ac57a8d84fc32
> Author: Florian Westphal <[email-masked]>
> Date:   Wed Apr 21 07:51:08 2021 +0000
> 
>     netfilter: arp_tables: pass table pointer via nf_hook_ops
> 
> bisection log:
> https://syzkaller.appspot.com/x/bisect.txt?x=13b88400300000 final
> oops:     https://syzkaller.appspot.com/x/report.txt?x=10788400300000
> console output:
> https://syzkaller.appspot.com/x/log.txt?x=17b88400300000
> 

This one is similar to previous zero-size vmalloc, I guess :)

#syz test
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

With regards,
Pavel Skripkin
>From b1ed745713bb840e0778c5a13f1f83f535dca044 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <[email-masked]>
Date: Wed, 23 Jun 2021 19:18:09 +0300
Subject: [PATCH] media: dvb-usb: fix wrong definition

/* ..... */

Signed-off-by: Pavel Skripkin <[email-masked]>
---
 drivers/media/usb/dvb-usb/cxusb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c
index 761992ad05e2..7707de7bae7c 100644
--- a/drivers/media/usb/dvb-usb/cxusb.c
+++ b/drivers/media/usb/dvb-usb/cxusb.c
@@ -1947,7 +1947,7 @@ static struct dvb_usb_device_properties cxusb_bluebird_lgz201_properties = {
 
 	.size_of_priv     = sizeof(struct cxusb_state),
 
-	.num_adapters = 2,
+	.num_adapters = 1,
 	.adapter = {
 		{
 		.num_frontends = 1,
-- 
2.32.0