Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1392821

[PATCH 4.5 118/200] [media] videobuf2-v4l2: Verify planes array in buffer dequeueing

Show all headers | View raw

4.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sakari Ailus <sakari.ailus@linux.intel.com>

commit 2c1f6951a8a82e6de0d82b1158b5e493fc6c54ab upstream.

When a buffer is being dequeued using VIDIOC_DQBUF IOCTL, the exact buffer
which will be dequeued is not known until the buffer has been removed from
the queue. The number of planes is specific to a buffer, not to the queue.

This does lead to the situation where multi-plane buffers may be requested
and queued with n planes, but VIDIOC_DQBUF IOCTL may be passed an argument
struct with fewer planes.

__fill_v4l2_buffer() however uses the number of planes from the dequeued
videobuf2 buffer, overwriting kernel memory (the m.planes array allocated
in video_usercopy() in v4l2-ioctl.c)  if the user provided fewer
planes than the dequeued buffer had. Oops!

Fixes: b0e0e1f83de3 ("[media] media: videobuf2: Prepare to divide videobuf2")

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/v4l2-core/videobuf2-v4l2.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/drivers/media/v4l2-core/videobuf2-v4l2.c
+++ b/drivers/media/v4l2-core/videobuf2-v4l2.c
@@ -74,6 +74,11 @@ static int __verify_planes_array(struct
 	return 0;
 }
 
+static int __verify_planes_array_core(struct vb2_buffer *vb, const void *pb)
+{
+	return __verify_planes_array(vb, pb);
+}
+
 /**
  * __verify_length() - Verify that the bytesused value for each plane fits in
  * the plane length and that the data offset doesn't exceed the bytesused value.
@@ -437,6 +442,7 @@ static int __fill_vb2_buffer(struct vb2_
 }
 
 static const struct vb2_buf_ops v4l2_buf_ops = {
+	.verify_planes_array	= __verify_planes_array_core,
 	.fill_user_buffer	= __fill_v4l2_buffer,
 	.fill_vb2_buffer	= __fill_vb2_buffer,
 	.copy_timestamp		= __copy_timestamp,

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.5 000/200] 4.5.3-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:20 +0200
  [PATCH 4.5 064/200] powerpc: scan_features() updates incorrect bits for REAL_LE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:20 +0200
  [PATCH 4.5 048/200] drm/nouveau/core: use vzalloc for allocating ramht Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:20 +0200
  [PATCH 4.5 073/200] pinctrl: single: Fix pcs_parse_bits_in_pinctrl_entry to use __ffs than ffs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:20 +0200
  [PATCH 4.5 006/200] kvm: x86: do not leak guest xcr0 into host interrupt handlers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:20 +0200
  [PATCH 4.5 117/200] [media] videobuf2-core: Check user space planes array in dqbuf Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:20 +0200
  [PATCH 4.5 067/200] nl80211: check netlink protocol in socket release notification Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:20 +0200
  [PATCH 4.5 114/200] ASoC: rt5640: Correct the digital interface data select Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:20 +0200
  [PATCH 4.5 120/200] cxl: Keep IRQ mappings on context teardown Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:20 +0200
  [PATCH 4.5 066/200] powerpc: Update TM user feature bits in scan_features() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:20 +0200
  [PATCH 4.5 116/200] [media] media: vb2: Fix regression on poll() for RW mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:20 +0200
  [PATCH 4.5 062/200] crypto: talitos - fix crash in talitos_cra_init() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:20 +0200
  [PATCH 4.5 096/200] drm/amdkfd: uninitialized variable in dbgdev_wave_control_set_registers() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:20 +0200
  [PATCH 4.5 070/200] Input: pmic8xxx-pwrkey - fix algorithm for converting trigger delay Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:20 +0200
  [PATCH 4.5 118/200] [media] videobuf2-v4l2: Verify planes array in buffer dequeueing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:20 +0200
    Re: [PATCH 4.5 118/200] [media] videobuf2-v4l2: Verify planes array  in buffer dequeueing Mauro Carvalho Chehab <mchehab@osg.samsung.com> - 2016-05-11 18:40 +0200
  [PATCH 4.5 119/200] [media] v4l2-dv-timings.h: fix polarity for 4k formats Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:20 +0200
  [PATCH 4.5 107/200] ACPICA / Interpreter: Fix a regression triggered because of wrong Linux ECDT support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:20 +0200
  [PATCH 4.5 112/200] ASoC: ssm4567: Reset device before regcache_sync() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:20 +0200
  [PATCH 4.5 061/200] crypto: sha1-mb - use corrcet pointer while completing jobs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:20 +0200
  [PATCH 4.5 106/200] i2c: exynos5: Fix possible ABBA deadlock by keeping I2C clock prepared Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:20 +0200
  [PATCH 4.5 047/200] futex: Acknowledge a new waiter in counter before plist Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:20 +0200
  [PATCH 4.5 056/200] s390/pci: add extra padding to function measurement block Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:20 +0200
  [PATCH 4.5 057/200] iwlwifi: pcie: lower the debug level for RSA semaphore access Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:20 +0200
  [PATCH 4.5 105/200] i2c: cpm: Fix build break due to incompatible pointer types Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:20 +0200
  [PATCH 4.5 063/200] crypto: talitos - fix AEAD tcrypt tests Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:20 +0200
  [PATCH 4.5 009/200] ARM: dts: am43xx: fix edma memcpy channel allocation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:20 +0200
  [PATCH 4.5 115/200] [media] vb2-memops: Fix over allocation of frame vectors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:20 +0200
  [PATCH 4.5 075/200] iommu/dma: Restore scatterlist offsets correctly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:20 +0200
  [PATCH 4.5 042/200] ALSA: pcxhr: Fix missing mutex unlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
  [PATCH 4.5 022/200] usb: gadget: f_fs: Fix use-after-free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
  [PATCH 4.5 025/200] lib: lz4: fixed zram with lz4 on big endian machines Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
  [PATCH 4.5 004/200] efi/arm64: Dont apply MEMBLOCK_NOMAP to UEFI memory map mapping Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
  [PATCH 4.5 024/200] dm cache metadata: fix cmd_read_lock() acquiring write lock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
  [PATCH 4.5 029/200] dmaengine: hsu: correct residue calculation of active descriptor Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
  [PATCH 4.5 032/200] dmaengine: pxa_dma: fix the maximum requestor line Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
  [PATCH 4.5 015/200] xhci: resume USB 3 roothub first Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
  [PATCH 4.5 028/200] dmaengine: hsu: correct use of channel status register Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
  [PATCH 4.5 016/200] usb: host: xhci: add a new quirk XHCI_NO_64BIT_SUPPORT Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
  [PATCH 4.5 014/200] usb: xhci: applying XHCI_PME_STUCK_QUIRK to Intel BXT B0 host Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
  [PATCH 4.5 005/200] x86/mce: Avoid using object after free in genpool Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
  [PATCH 4.5 002/200] block: partition: initialize percpuref before sending out KOBJ_ADD Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
  [PATCH 4.5 031/200] dmaengine: edma: Remove dynamic TPTC power management feature Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
  [PATCH 4.5 040/200] ALSA: hda - Keep powering up ADCs on Cirrus codecs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
  [PATCH 4.5 033/200] mtd: nand: pxa3xx_nand: fix dmaengine initialization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
  [PATCH 4.5 026/200] debugfs: Make automount point inodes permanently empty Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
  [PATCH 4.5 044/200] ALSA: hda - Update BCLK also at hotplug for i915 HSW/BDW Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
  [PATCH 4.5 011/200] ARM: OMAP2: Fix up interconnect barrier initialization for DRA7 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
  [PATCH 4.5 018/200] usb: xhci: fix wild pointers in xhci_mem_cleanup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
  [PATCH 4.5 030/200] dmaengine: omap-dma: Fix polled channel completion detection and handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
  [PATCH 4.5 023/200] dm cache metadata: fix READ_LOCK macros and cleanup WRITE_LOCK macros Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
  [PATCH 4.5 043/200] ALSA: hda - Add dock support for ThinkPad X260 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
  [PATCH 4.5 027/200] dmaengine: dw: fix master selection Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
  [PATCH 4.5 001/200] mmc: block: Use the mmc host device index as the mmcblk device index Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
  [PATCH 4.5 010/200] ARM: mvebu: Correct unit address for linksys Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
  Re: [PATCH 4.5 000/200] 4.5.3-stable review Guenter Roeck <linux@roeck-us.net> - 2016-05-03 09:50 +0200
    Re: [PATCH 4.5 000/200] 4.5.3-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 20:30 +0200
      Re: [PATCH 4.5 000/200] 4.5.3-stable review Guenter Roeck <linux@roeck-us.net> - 2016-05-04 04:30 +0200
  Re: [PATCH 4.5 000/200] 4.5.3-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-05-03 17:00 +0200
    Re: [PATCH 4.5 000/200] 4.5.3-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 20:20 +0200

csiph-web