From: Michael Ellerman <mpe@ellerman.id.au>
To: Linus Torvalds <torvalds@linuxfoundation.org>,
Salvatore Bonaccorso <carnil@debian.org>
Cc: Dan Carpenter <dan.carpenter@oracle.com>,
Stefan Richter <stefanr@s5r6.in-berlin.de>,
Luo Likang <luolikang@nsfocus.com>,
Mauro Carvalho Chehab <mchehab@kernel.org>,
Linux Media Mailing List <linux-media@vger.kernel.org>,
linux1394-devel@lists.sourceforge.net,
Yang Yanchao <yangyanchao6@huawei.com>,
Security Officers <security@kernel.org>
Subject: Re: [PATCH v2 RESEND] media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()
Date: Mon, 13 Sep 2021 12:50:19 +1000 [thread overview]
Message-ID: <87pmtdkx3o.fsf@mpe.ellerman.id.au> (raw)
In-Reply-To: <CAHk-=wjOW3Fx8td1Snezd1_9sf8q7KuQx8TyQNR0ypS2rVBHtg@mail.gmail.com>
Linus Torvalds <torvalds@linuxfoundation.org> writes:
> On Sun, Sep 12, 2021 at 6:14 AM Salvatore Bonaccorso <carnil@debian.org> wrote:
>>
>> On Wed, Sep 01, 2021 at 01:40:26PM +0300, Dan Carpenter wrote:
>> > On Mon, Aug 16, 2021 at 10:27:22AM +0300, Dan Carpenter wrote:
>> > > The bounds checking in avc_ca_pmt() is not strict enough. It should
>> > > be checking "read_pos + 4" because it's reading 5 bytes. If the
>> > > "es_info_length" is non-zero then it reads a 6th byte so there needs to
>> > > be an additional check for that.
>> > >
>> > > I also added checks for the "write_pos". I don't think these are
>> > > required because "read_pos" and "write_pos" are tied together so
>> > > checking one ought to be enough.
>
> They may be in sync at a fixed offset, but the buffer length of the
> read ("int length") is not in sync with the buffer length for the
> write ("sizeof(c->operand)").
>
> So I do think the write pos limit checking is actually necessary and needed.
>
>> > > RESEND: this patch got lost somehow.
>> >
>> > What the heck? Someone on patchwork just marked this patch as obsolete
>> > again!!!
>
> Can we please make sure patchwork has some logging so that that kind
> of thing shows _who_ did this?
It's not easily visible in the web UI, but patchwork does log that sort
of info.
The v2 RESEND is:
https://patchwork.linuxtv.org/project/linux-media/patch/20210816072721.GA10534@kili/
In the top right is the patch id (76352), you can then get the list of
events for that patch at:
https://patchwork.linuxtv.org/api/events/?patch=76352
Which shows that hverkuil changed it to obsolete on 2021-09-01T10:16:43.
Presumably because they picked up the non-resend version, which was
marked as under-review around the same time:
https://patchwork.linuxtv.org/api/events/?patch=74849
And then also visible on the above page, it was marked as accepted by
mchehab on 2021-09-03T13:06:16.
But I don't see the patch in linux-next, or in linux-media.git, so I'm
not sure where it's been accepted to?
cheers
next prev parent reply other threads:[~2021-09-13 2:50 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <000001d73031$d5304480$7f90cd80$@nsfocus.com>
2021-04-14 8:57 ` [PATCH] media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt() Dan Carpenter
2021-04-19 21:42 ` Kees Cook
2021-06-07 15:23 ` [PATCH v2] " Dan Carpenter
2021-07-16 9:28 ` Petr Mladek
2021-07-19 10:25 ` [PATCH] " Dan Carpenter
2021-07-29 10:32 ` Greg KH
2021-08-16 7:01 ` Salvatore Bonaccorso
2021-08-16 7:27 ` [PATCH v2 RESEND] " Dan Carpenter
2021-09-01 10:40 ` Dan Carpenter
2021-09-12 13:14 ` Salvatore Bonaccorso
2021-09-12 18:26 ` Linus Torvalds
2021-09-13 2:50 ` Michael Ellerman [this message]
2021-09-13 13:23 ` Mauro Carvalho Chehab
2021-09-19 18:45 ` Salvatore Bonaccorso
2021-10-11 7:04 ` Salvatore Bonaccorso
2021-10-11 9:42 ` [PATCH] " Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87pmtdkx3o.fsf@mpe.ellerman.id.au \
--to=mpe@ellerman.id.au \
--cc=carnil@debian.org \
--cc=dan.carpenter@oracle.com \
--cc=linux-media@vger.kernel.org \
--cc=linux1394-devel@lists.sourceforge.net \
--cc=luolikang@nsfocus.com \
--cc=mchehab@kernel.org \
--cc=security@kernel.org \
--cc=stefanr@s5r6.in-berlin.de \
--cc=torvalds@linuxfoundation.org \
--cc=yangyanchao6@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.