From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Hangyu Hua <hbh25y@gmail.com>,
Sergey Senozhatsky <senozhatsky@chromium.org>,
Hans Verkuil <hverkuil-cisco@xs4all.nl>,
Mauro Carvalho Chehab <mchehab@kernel.org>
Subject: [PATCH 5.4 15/30] media: dvb_vb2: fix possible out of bound access
Date: Mon, 3 Oct 2022 09:11:57 +0200 [thread overview]
Message-ID: <20221003070716.738139156@linuxfoundation.org> (raw)
In-Reply-To: <20221003070716.269502440@linuxfoundation.org>
From: Hangyu Hua <hbh25y@gmail.com>
commit 37238699073e7e93f05517e529661151173cd458 upstream.
vb2_core_qbuf and vb2_core_querybuf don't check the range of b->index
controlled by the user.
Fix this by adding range checking code before using them.
Fixes: 57868acc369a ("media: videobuf2: Add new uAPI for DVB streaming I/O")
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/dvb-core/dvb_vb2.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/drivers/media/dvb-core/dvb_vb2.c
+++ b/drivers/media/dvb-core/dvb_vb2.c
@@ -358,6 +358,12 @@ int dvb_vb2_reqbufs(struct dvb_vb2_ctx *
int dvb_vb2_querybuf(struct dvb_vb2_ctx *ctx, struct dmx_buffer *b)
{
+ struct vb2_queue *q = &ctx->vb_q;
+
+ if (b->index >= q->num_buffers) {
+ dprintk(1, "[%s] buffer index out of range\n", ctx->name);
+ return -EINVAL;
+ }
vb2_core_querybuf(&ctx->vb_q, b->index, b);
dprintk(3, "[%s] index=%d\n", ctx->name, b->index);
return 0;
@@ -382,8 +388,13 @@ int dvb_vb2_expbuf(struct dvb_vb2_ctx *c
int dvb_vb2_qbuf(struct dvb_vb2_ctx *ctx, struct dmx_buffer *b)
{
+ struct vb2_queue *q = &ctx->vb_q;
int ret;
+ if (b->index >= q->num_buffers) {
+ dprintk(1, "[%s] buffer index out of range\n", ctx->name);
+ return -EINVAL;
+ }
ret = vb2_core_qbuf(&ctx->vb_q, b->index, b, NULL);
if (ret) {
dprintk(1, "[%s] index=%d errno=%d\n", ctx->name,
next prev parent reply other threads:[~2022-10-03 7:44 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-03 7:11 [PATCH 5.4 00/30] 5.4.216-rc1 review Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.4 01/30] uas: add no-uas quirk for Hiksemi usb_disk Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.4 02/30] usb-storage: Add Hiksemi USB3-FW to IGNORE_UAS Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.4 03/30] uas: ignore UAS for Thinkplus chips Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.4 04/30] net: usb: qmi_wwan: Add new usb-id for Dell branded EM7455 Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.4 05/30] clk: ingenic-tcu: Properly enable registers before accessing timers Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.4 06/30] ARM: dts: integrator: Tag PCI host with device_type Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.4 07/30] ntfs: fix BUG_ON in ntfs_lookup_inode_by_name() Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.4 08/30] Revert "net: mvpp2: debugfs: fix memory leak when using debugfs_lookup()" Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.4 09/30] libata: add ATA_HORKAGE_NOLPM for Pioneer BDR-207M and BDR-205 Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.4 10/30] mmc: moxart: fix 4-bit bus width and remove 8-bit bus width Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.4 11/30] mm/page_alloc: fix race condition between build_all_zonelists and page allocation Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.4 12/30] mm: prevent page_frag_alloc() from corrupting the memory Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.4 13/30] mm/migrate_device.c: flush TLB while holding PTL Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.4 14/30] mm: fix madivse_pageout mishandling on non-LRU page Greg Kroah-Hartman
2022-10-03 7:11 ` Greg Kroah-Hartman [this message]
2022-10-03 7:11 ` [PATCH 5.4 16/30] ARM: dts: Move am33xx and am43xx mmc nodes to sdhci-omap driver Greg Kroah-Hartman
2022-10-03 7:11 ` [PATCH 5.4 17/30] ARM: dts: am33xx: Fix MMCHS0 dma properties Greg Kroah-Hartman
2022-10-03 7:12 ` [PATCH 5.4 18/30] soc: sunxi: sram: Actually claim SRAM regions Greg Kroah-Hartman
2022-10-03 7:12 ` [PATCH 5.4 19/30] soc: sunxi: sram: Prevent the driver from being unbound Greg Kroah-Hartman
2022-10-03 7:12 ` [PATCH 5.4 20/30] soc: sunxi_sram: Make use of the helper function devm_platform_ioremap_resource() Greg Kroah-Hartman
2022-10-03 7:12 ` [PATCH 5.4 21/30] soc: sunxi: sram: Fix probe function ordering issues Greg Kroah-Hartman
2022-10-03 7:12 ` [PATCH 5.4 22/30] soc: sunxi: sram: Fix debugfs info for A64 SRAM C Greg Kroah-Hartman
2022-10-03 7:12 ` [PATCH 5.4 23/30] Revert "drm: bridge: analogix/dp: add panel prepare/unprepare in suspend/resume time" Greg Kroah-Hartman
2022-10-03 7:12 ` [PATCH 5.4 24/30] Input: melfas_mip4 - fix return value check in mip4_probe() Greg Kroah-Hartman
2022-10-03 7:12 ` [PATCH 5.4 25/30] usbnet: Fix memory leak in usbnet_disconnect() Greg Kroah-Hartman
2022-10-03 7:12 ` [PATCH 5.4 26/30] nvme: add new line after variable declatation Greg Kroah-Hartman
2022-10-03 7:12 ` [PATCH 5.4 27/30] nvme: Fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices Greg Kroah-Hartman
2022-10-03 7:12 ` [PATCH 5.4 28/30] selftests: Fix the if conditions of in test_extra_filter() Greg Kroah-Hartman
2022-10-03 7:12 ` [PATCH 5.4 29/30] clk: imx: imx6sx: remove the SET_RATE_PARENT flag for QSPI clocks Greg Kroah-Hartman
2022-10-03 7:12 ` [PATCH 5.4 30/30] clk: iproc: Do not rely on node name for correct PLL setup Greg Kroah-Hartman
2022-10-03 11:31 ` [PATCH 5.4 00/30] 5.4.216-rc1 review Jon Hunter
2022-10-03 17:44 ` Florian Fainelli
2022-10-03 17:58 ` Guenter Roeck
2022-10-03 23:49 ` Shuah Khan
2022-10-04 17:37 ` Greg Kroah-Hartman
2022-10-04 17:39 ` Shuah Khan
2022-10-05 10:39 ` Greg Kroah-Hartman
2022-10-04 8:55 ` Naresh Kamboju
2022-10-04 11:30 ` Sudip Mukherjee (Codethink)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221003070716.738139156@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=hbh25y@gmail.com \
--cc=hverkuil-cisco@xs4all.nl \
--cc=linux-kernel@vger.kernel.org \
--cc=mchehab@kernel.org \
--cc=senozhatsky@chromium.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).