From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
To: Hans Verkuil <hverkuil@xs4all.nl>
Cc: Linux Media Mailing List <linux-media@vger.kernel.org>,
Kieran Bingham <kieran.bingham@ideasonboard.com>
Subject: Re: [PATCH] v4l2-ctrls.c/uvc: zero v4l2_event
Date: Wed, 19 Dec 2018 00:03:52 +0200 [thread overview]
Message-ID: <4077901.8aWBV7DY5T@avalon> (raw)
In-Reply-To: <7ae211a5-29e2-0458-befc-20ef391d87e0@xs4all.nl>
Hi Hans,
Thank you for the patch.
On Tuesday, 18 December 2018 15:37:08 EET Hans Verkuil wrote:
> Control events can leak kernel memory since they do not fully zero the
> event. The same code is present in both v4l2-ctrls.c and uvc_ctrl.c, so
> fix both.
>
> It appears that all other event code is properly zeroing the structure,
> it's these two places.
Indeed :-(
maybe s/it's these/it's only these/ ?
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
I assume you will merge this directly, without a need for me to take the patch
in my UVC branch ?
> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
> Reported-by: syzbot+4f021cf3697781dbd9fb@syzkaller.appspotmail.com
> ---
> For details see:
> https://syzkaller.appspot.com/bug?extid=4f021cf3697781dbd9fb ---
> diff --git a/drivers/media/usb/uvc/uvc_ctrl.c
> b/drivers/media/usb/uvc/uvc_ctrl.c index d45415cbe6e7..14cff91b7aea 100644
> --- a/drivers/media/usb/uvc/uvc_ctrl.c
> +++ b/drivers/media/usb/uvc/uvc_ctrl.c
> @@ -1212,7 +1212,7 @@ static void uvc_ctrl_fill_event(struct uvc_video_chain
> *chain,
>
> __uvc_query_v4l2_ctrl(chain, ctrl, mapping, &v4l2_ctrl);
>
> - memset(ev->reserved, 0, sizeof(ev->reserved));
> + memset(ev, 0, sizeof(*ev));
> ev->type = V4L2_EVENT_CTRL;
> ev->id = v4l2_ctrl.id;
> ev->u.ctrl.value = value;
> diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c
> b/drivers/media/v4l2-core/v4l2-ctrls.c index 5e3806feb5d7..8a82427c4d54
> 100644
> --- a/drivers/media/v4l2-core/v4l2-ctrls.c
> +++ b/drivers/media/v4l2-core/v4l2-ctrls.c
> @@ -1387,7 +1387,7 @@ static u32 user_flags(const struct v4l2_ctrl *ctrl)
>
> static void fill_event(struct v4l2_event *ev, struct v4l2_ctrl *ctrl, u32
> changes) {
> - memset(ev->reserved, 0, sizeof(ev->reserved));
> + memset(ev, 0, sizeof(*ev));
> ev->type = V4L2_EVENT_CTRL;
> ev->id = ctrl->id;
> ev->u.ctrl.changes = changes;
--
Regards,
Laurent Pinchart
prev parent reply other threads:[~2018-12-18 22:03 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-12-18 13:37 [PATCH] v4l2-ctrls.c/uvc: zero v4l2_event Hans Verkuil
2018-12-18 22:03 ` Laurent Pinchart [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4077901.8aWBV7DY5T@avalon \
--to=laurent.pinchart@ideasonboard.com \
--cc=hverkuil@xs4all.nl \
--cc=kieran.bingham@ideasonboard.com \
--cc=linux-media@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.