CVE-2021-47578

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: scsi_debug: Don't call kcalloc() if size arg is zero

If the size arg to kcalloc() is zero, it returns ZERO_SIZE_PTR. Because of

that, for a following NULL pointer check to work on the returned pointer,

kcalloc() must not be called with the size arg equal to zero. Return early

without error before the kcalloc() call if size arg is zero.

BUG: KASAN: null-ptr-deref in memcpy include/linux/fortify-string.h:191 [inline]

BUG: KASAN: null-ptr-deref in sg_copy_buffer+0x138/0x240 lib/scatterlist.c:974

Write of size 4 at addr 0000000000000010 by task syz-executor.1/22789

CPU: 1 PID: 22789 Comm: syz-executor.1 Not tainted 5.15.0-syzk #1

Hardware name: Red Hat KVM, BIOS 1.13.0-2

Call Trace:

__dump_stack lib/dump_stack.c:88 [inline]

dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:106

__kasan_report mm/kasan/report.c:446 [inline]

kasan_report.cold.14+0x112/0x117 mm/kasan/report.c:459

check_region_inline mm/kasan/generic.c:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References