From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
To: Dan Carpenter <dan.carpenter@oracle.com>,
Mauro Carvalho Chehab <mchehab+huawei@kernel.org>,
Arnd Bergmann <arnd@arndb.de>
Cc: Sakari Ailus <sakari.ailus@linux.intel.com>,
Ezequiel Garcia <ezequiel@collabora.com>,
Boris Brezillon <boris.brezillon@collabora.com>,
Vandana BN <bnvandana@gmail.com>,
linux-media@vger.kernel.org, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [PATCH] media: v4l2-core: Fix Oops in ioctl
Date: Wed, 8 Jan 2020 12:12:29 +0100 [thread overview]
Message-ID: <4907cc69-9355-203e-76fc-33fb9452102b@xs4all.nl> (raw)
In-Reply-To: <20200108105929.7kxwf5rthxnhwbuh@kili.mountain>
Hi Dan,
Marking this as Obsoleted in patchwork since Arnd posted an identical patch for
this already.
Regards,
Hans
On 1/8/20 11:59 AM, Dan Carpenter wrote:
> Syzbot reported a crash in video_usercopy(). It turns out when we
> broke video_get_user() into a separate function then we accidentally
> moved it outside the if block so it tries to memset a user pointer.
>
> Reported-by: syzbot+9240c422be249a8422bd@syzkaller.appspotmail.com
> Fixes: c8ef1a6076bf ("media: v4l2-core: split out data copy from video_usercopy")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> Not actually tested. :( Sorry.
>
> drivers/media/v4l2-core/v4l2-ioctl.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
> index b68ff06009cd..aaf83e254272 100644
> --- a/drivers/media/v4l2-core/v4l2-ioctl.c
> +++ b/drivers/media/v4l2-core/v4l2-ioctl.c
> @@ -3205,12 +3205,12 @@ video_usercopy(struct file *file, unsigned int orig_cmd, unsigned long arg,
> parg = mbuf;
> }
>
> + err = video_get_user((void __user *)arg, parg, orig_cmd,
> + &always_copy);
> + if (err)
> + goto out;
> }
>
> - err = video_get_user((void __user *)arg, parg, orig_cmd, &always_copy);
> - if (err)
> - goto out;
> -
> err = check_array_args(cmd, parg, &array_size, &user_ptr, &kernel_ptr);
> if (err < 0)
> goto out;
>
prev parent reply other threads:[~2020-01-08 11:12 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-08 8:54 KASAN: null-ptr-deref Write in video_usercopy syzbot
2020-01-08 10:59 ` [PATCH] media: v4l2-core: Fix Oops in ioctl Dan Carpenter
2020-01-08 11:12 ` Hans Verkuil [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4907cc69-9355-203e-76fc-33fb9452102b@xs4all.nl \
--to=hverkuil-cisco@xs4all.nl \
--cc=arnd@arndb.de \
--cc=bnvandana@gmail.com \
--cc=boris.brezillon@collabora.com \
--cc=dan.carpenter@oracle.com \
--cc=ezequiel@collabora.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab+huawei@kernel.org \
--cc=sakari.ailus@linux.intel.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.