Received-SPF: softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) client-ip=23.128.96.19;
From:   "Fabio M. De Francesco" <fmdefrancesco@gmail.com>
To:     syzbot <syzbot+d55757faa9b80590767b@syzkaller.appspotmail.com>,
        syzkaller-bugs@googlegroups.com
Cc:     dhowells@redhat.com, christophe.jaillet@wanadoo.fr,
        linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
        David Howells <dhowells@redhat.com>
Subject: Re: [syzbot] KASAN: null-ptr-deref Read in __free_pages
Date:   Mon, 21 Mar 2022 09:50:05 +0100
Message-ID: <1905446.yKVeVyVuyW@leap>
In-Reply-To: <970502.1647851062@warthog.procyon.org.uk>
References: <000000000000b1807c05daad8f98@google.com> <970502.1647851062@warthog.procyon.org.uk>
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On luned=C3=AC 21 marzo 2022 09:24:22 CET David Howells wrote:
> It should be possible to just test for the pointer being NULL in the loop
> before calling __free_pages() since the list was allocated with kcalloc().
>=20
> David
>=20
> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-f=
s.git 6d39b096627f0a1eb6e14f049d8ae3c93e0290f2
>=20
> --=20
> You received this message because you are subscribed to the Google Groups=
 "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an=
 email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgi=
d/syzkaller-bugs/970502.1647851062%40warthog.procyon.org.uk.
>=20
This way you are doing two test for each iteration of the loop that calls
__free_pages(). One for the index "i" to stay less that an unnecessary=20
high limit, the other for pages[i] being NULL.

However, since you are the Maintainer, yours are the rules :)

Regards,

=46abio M. De Francesco