All of lore.kernel.org
 help / color / mirror / Atom feed
* [Linux-kernel-mentees] [PATCH] media/v4l2-core: Fix kernel-infoleak in video_put_user()
@ 2020-07-26 16:44 ` Peilin Ye
  0 siblings, 0 replies; 76+ messages in thread
From: Peilin Ye @ 2020-07-26 16:44 UTC (permalink / raw)
  To: Mauro Carvalho Chehab
  Cc: Peilin Ye, Greg Kroah-Hartman, syzkaller-bugs, Hans Verkuil,
	Sakari Ailus, Arnd Bergmann, Laurent Pinchart, Vandana BN,
	Ezequiel Garcia, Niklas Söderlund, linux-kernel-mentees,
	linux-media, linux-kernel

video_put_user() is copying uninitialized stack memory to userspace. Fix
it by initializing `vb32` using memset().

Reported-and-tested-by: syzbot+79d751604cb6f29fbf59@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=79d751604cb6f29fbf59
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
---
 drivers/media/v4l2-core/v4l2-ioctl.c | 32 +++++++++++++++-------------
 1 file changed, 17 insertions(+), 15 deletions(-)

diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
index a556880f225a..08909f58dc80 100644
--- a/drivers/media/v4l2-core/v4l2-ioctl.c
+++ b/drivers/media/v4l2-core/v4l2-ioctl.c
@@ -3210,21 +3210,23 @@ static int video_put_user(void __user *arg, void *parg, unsigned int cmd)
 	case VIDIOC_DQBUF_TIME32:
 	case VIDIOC_PREPARE_BUF_TIME32: {
 		struct v4l2_buffer *vb = parg;
-		struct v4l2_buffer_time32 vb32 = {
-			.index		= vb->index,
-			.type		= vb->type,
-			.bytesused	= vb->bytesused,
-			.flags		= vb->flags,
-			.field		= vb->field,
-			.timestamp.tv_sec	= vb->timestamp.tv_sec,
-			.timestamp.tv_usec	= vb->timestamp.tv_usec,
-			.timecode	= vb->timecode,
-			.sequence	= vb->sequence,
-			.memory		= vb->memory,
-			.m.userptr	= vb->m.userptr,
-			.length		= vb->length,
-			.request_fd	= vb->request_fd,
-		};
+		struct v4l2_buffer_time32 vb32;
+
+		memset(&vb32, 0, sizeof(vb32));
+
+		vb32.index	= vb->index;
+		vb32.type	= vb->type;
+		vb32.bytesused	= vb->bytesused;
+		vb32.flags	= vb->flags;
+		vb32.field	= vb->field;
+		vb32.timestamp.tv_sec	= vb->timestamp.tv_sec;
+		vb32.timestamp.tv_usec	= vb->timestamp.tv_usec;
+		vb32.timecode	= vb->timecode;
+		vb32.sequence	= vb->sequence;
+		vb32.memory	= vb->memory;
+		vb32.m.userptr	= vb->m.userptr;
+		vb32.length	= vb->length;
+		vb32.request_fd	= vb->request_fd;
 
 		if (copy_to_user(arg, &vb32, sizeof(vb32)))
 			return -EFAULT;
-- 
2.25.1


^ permalink raw reply related	[flat|nested] 76+ messages in thread

end of thread, other threads:[~2020-08-02 16:55 UTC | newest]

Thread overview: 76+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-07-26 16:44 [Linux-kernel-mentees] [PATCH] media/v4l2-core: Fix kernel-infoleak in video_put_user() Peilin Ye
2020-07-26 16:44 ` Peilin Ye
2020-07-26 17:30 ` Laurent Pinchart
2020-07-26 17:30   ` Laurent Pinchart
2020-07-26 18:07   ` Peilin Ye
2020-07-26 18:07     ` Peilin Ye
2020-07-26 22:08     ` Laurent Pinchart
2020-07-26 22:08       ` Laurent Pinchart
2020-07-26 22:15       ` Peilin Ye
2020-07-26 22:15         ` Peilin Ye
2020-07-26 18:12   ` Peilin Ye
2020-07-26 18:12     ` Peilin Ye
2020-07-26 22:05 ` [Linux-kernel-mentees] [PATCH v2] " Peilin Ye
2020-07-26 22:05   ` Peilin Ye
2020-07-26 22:10   ` Laurent Pinchart
2020-07-26 22:10     ` Laurent Pinchart
2020-07-26 22:16     ` Peilin Ye
2020-07-26 22:16       ` Peilin Ye
2020-07-26 22:27   ` [Linux-kernel-mentees] [PATCH v3] " Peilin Ye
2020-07-26 22:27     ` Peilin Ye
2020-07-27  7:25     ` Arnd Bergmann
2020-07-27  7:25       ` Arnd Bergmann
2020-07-27  7:56       ` Peilin Ye
2020-07-27  7:56         ` Peilin Ye
2020-07-27 13:16       ` Dan Carpenter
2020-07-27 13:16         ` Dan Carpenter
2020-07-27 14:05         ` Arnd Bergmann
2020-07-27 14:05           ` Arnd Bergmann
2020-07-27 14:14           ` Peilin Ye
2020-07-27 14:14             ` Peilin Ye
2020-07-27 14:20             ` Arnd Bergmann
2020-07-27 14:20               ` Arnd Bergmann
2020-07-27 14:46             ` Dan Carpenter
2020-07-27 14:46               ` Dan Carpenter
2020-07-27 15:30               ` Peilin Ye
2020-07-27 15:30                 ` Peilin Ye
2020-07-27 14:43           ` Dan Carpenter
2020-07-27 14:43             ` Dan Carpenter
2020-07-27 14:55             ` Arnd Bergmann
2020-07-27 14:55               ` Arnd Bergmann
2020-07-27 22:04         ` Peilin Ye
2020-07-27 22:04           ` Peilin Ye
2020-07-28  9:00           ` Arnd Bergmann
2020-07-28  9:00             ` Arnd Bergmann
2020-07-28 10:02           ` Dan Carpenter
2020-07-28 10:02             ` Dan Carpenter
2020-07-27 22:33         ` Peilin Ye
2020-07-27 22:33           ` Peilin Ye
2020-07-28  9:10           ` Arnd Bergmann
2020-07-28  9:10             ` Arnd Bergmann
2020-07-28  9:47           ` Dan Carpenter
2020-07-28  9:47             ` Dan Carpenter
2020-07-28 13:13             ` Peilin Ye
2020-07-28 13:13               ` Peilin Ye
2020-07-28 12:22         ` Linus Walleij
2020-07-28 12:22           ` Linus Walleij
2020-07-28 13:06           ` Dan Carpenter
2020-07-28 13:06             ` Dan Carpenter
2020-07-28 13:58             ` Arnd Bergmann
2020-07-28 13:58               ` Arnd Bergmann
2020-07-30  8:07               ` Bartosz Golaszewski
2020-07-30  8:07                 ` Bartosz Golaszewski
2020-07-30  8:15                 ` Arnd Bergmann
2020-07-30  8:15                   ` Arnd Bergmann
2020-07-30  8:38                   ` Andy Shevchenko
2020-07-30  8:38                     ` Andy Shevchenko
2020-07-30  9:18                     ` Arnd Bergmann
2020-07-30  9:18                       ` Arnd Bergmann
2020-07-30 11:48                       ` Andy Shevchenko
2020-07-30 11:48                         ` Andy Shevchenko
2020-07-30 13:49                         ` Arnd Bergmann
2020-07-30 13:49                           ` Arnd Bergmann
2020-08-02 16:55         ` Peilin Ye
2020-08-02 16:55           ` Peilin Ye
2020-07-27  8:00     ` [Linux-kernel-mentees] [PATCH v4] " Peilin Ye
2020-07-27  8:00       ` Peilin Ye

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.