From: Arnd Bergmann <arnd@arndb.de>
To: Peilin Ye <yepeilin.cs@gmail.com>
Cc: "Mauro Carvalho Chehab" <mchehab@kernel.org>,
"Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
syzkaller-bugs <syzkaller-bugs@googlegroups.com>,
"Hans Verkuil" <hverkuil-cisco@xs4all.nl>,
"Sakari Ailus" <sakari.ailus@linux.intel.com>,
"Laurent Pinchart" <laurent.pinchart@ideasonboard.com>,
"Vandana BN" <bnvandana@gmail.com>,
"Ezequiel Garcia" <ezequiel@collabora.com>,
"Niklas Söderlund" <niklas.soderlund+renesas@ragnatech.se>,
linux-kernel-mentees@lists.linuxfoundation.org,
"Linux Media Mailing List" <linux-media@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: [Linux-kernel-mentees] [PATCH v3] media/v4l2-core: Fix kernel-infoleak in video_put_user()
Date: Mon, 27 Jul 2020 09:25:16 +0200 [thread overview]
Message-ID: <CAK8P3a3NB2BVo9fH-Wcinrhhs-QJ=9dK59Ds83TvgLmEkRy3qA@mail.gmail.com> (raw)
In-Reply-To: <20200726222703.102701-1-yepeilin.cs@gmail.com>
On Mon, Jul 27, 2020 at 12:28 AM Peilin Ye <yepeilin.cs@gmail.com> wrote:
>
> video_put_user() is copying uninitialized stack memory to userspace due
> to the compiler not initializing holes in the structures declared on the
> stack. Fix it by initializing `ev32` and `vb32` using memset().
>
> Reported-and-tested-by: syzbot+79d751604cb6f29fbf59@syzkaller.appspotmail.com
> Link: https://syzkaller.appspot.com/bug?extid=79d751604cb6f29fbf59
> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
> Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Thanks a lot for addressing this! I now see that I actually created a similar
bugfix for it back in January, but for some reason that got stuck in my
backlog and I never wrote a proper description for it or sent it out to the
list, sorry about that. I would hope we could find a way to have either
the compiler or sparse warn if we copy uninitialized data to user space,
but we now don't even check for that within the kernel any more.
I would suggest adding these tags to the patch, to ensure it gets backported
to stable kernels as needed:
Cc: stable@vger.kernel.org
Fixes: 1a6c0b36dd19 ("media: v4l2-core: fix VIDIOC_DQEVENT for time64 ABI")
Fixes: 577c89b0ce72 ("media: v4l2-core: fix v4l2_buffer handling for
time64 ABI")
In addition to
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
WARNING: multiple messages have this Message-ID (diff)
From: Arnd Bergmann <arnd@arndb.de>
To: Peilin Ye <yepeilin.cs@gmail.com>
Cc: "Niklas Söderlund" <niklas.soderlund+renesas@ragnatech.se>,
syzkaller-bugs <syzkaller-bugs@googlegroups.com>,
"Linux Media Mailing List" <linux-media@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"Laurent Pinchart" <laurent.pinchart@ideasonboard.com>,
"Sakari Ailus" <sakari.ailus@linux.intel.com>,
"Vandana BN" <bnvandana@gmail.com>,
"Hans Verkuil" <hverkuil-cisco@xs4all.nl>,
"Mauro Carvalho Chehab" <mchehab@kernel.org>,
"Ezequiel Garcia" <ezequiel@collabora.com>,
linux-kernel-mentees@lists.linuxfoundation.org
Subject: Re: [Linux-kernel-mentees] [PATCH v3] media/v4l2-core: Fix kernel-infoleak in video_put_user()
Date: Mon, 27 Jul 2020 09:25:16 +0200 [thread overview]
Message-ID: <CAK8P3a3NB2BVo9fH-Wcinrhhs-QJ=9dK59Ds83TvgLmEkRy3qA@mail.gmail.com> (raw)
In-Reply-To: <20200726222703.102701-1-yepeilin.cs@gmail.com>
On Mon, Jul 27, 2020 at 12:28 AM Peilin Ye <yepeilin.cs@gmail.com> wrote:
>
> video_put_user() is copying uninitialized stack memory to userspace due
> to the compiler not initializing holes in the structures declared on the
> stack. Fix it by initializing `ev32` and `vb32` using memset().
>
> Reported-and-tested-by: syzbot+79d751604cb6f29fbf59@syzkaller.appspotmail.com
> Link: https://syzkaller.appspot.com/bug?extid=79d751604cb6f29fbf59
> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
> Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Thanks a lot for addressing this! I now see that I actually created a similar
bugfix for it back in January, but for some reason that got stuck in my
backlog and I never wrote a proper description for it or sent it out to the
list, sorry about that. I would hope we could find a way to have either
the compiler or sparse warn if we copy uninitialized data to user space,
but we now don't even check for that within the kernel any more.
I would suggest adding these tags to the patch, to ensure it gets backported
to stable kernels as needed:
Cc: stable@vger.kernel.org
Fixes: 1a6c0b36dd19 ("media: v4l2-core: fix VIDIOC_DQEVENT for time64 ABI")
Fixes: 577c89b0ce72 ("media: v4l2-core: fix v4l2_buffer handling for
time64 ABI")
In addition to
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
next prev parent reply other threads:[~2020-07-27 7:25 UTC|newest]
Thread overview: 76+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-26 16:44 [Linux-kernel-mentees] [PATCH] media/v4l2-core: Fix kernel-infoleak in video_put_user() Peilin Ye
2020-07-26 16:44 ` Peilin Ye
2020-07-26 17:30 ` Laurent Pinchart
2020-07-26 17:30 ` Laurent Pinchart
2020-07-26 18:07 ` Peilin Ye
2020-07-26 18:07 ` Peilin Ye
2020-07-26 22:08 ` Laurent Pinchart
2020-07-26 22:08 ` Laurent Pinchart
2020-07-26 22:15 ` Peilin Ye
2020-07-26 22:15 ` Peilin Ye
2020-07-26 18:12 ` Peilin Ye
2020-07-26 18:12 ` Peilin Ye
2020-07-26 22:05 ` [Linux-kernel-mentees] [PATCH v2] " Peilin Ye
2020-07-26 22:05 ` Peilin Ye
2020-07-26 22:10 ` Laurent Pinchart
2020-07-26 22:10 ` Laurent Pinchart
2020-07-26 22:16 ` Peilin Ye
2020-07-26 22:16 ` Peilin Ye
2020-07-26 22:27 ` [Linux-kernel-mentees] [PATCH v3] " Peilin Ye
2020-07-26 22:27 ` Peilin Ye
2020-07-27 7:25 ` Arnd Bergmann [this message]
2020-07-27 7:25 ` Arnd Bergmann
2020-07-27 7:56 ` Peilin Ye
2020-07-27 7:56 ` Peilin Ye
2020-07-27 13:16 ` Dan Carpenter
2020-07-27 13:16 ` Dan Carpenter
2020-07-27 14:05 ` Arnd Bergmann
2020-07-27 14:05 ` Arnd Bergmann
2020-07-27 14:14 ` Peilin Ye
2020-07-27 14:14 ` Peilin Ye
2020-07-27 14:20 ` Arnd Bergmann
2020-07-27 14:20 ` Arnd Bergmann
2020-07-27 14:46 ` Dan Carpenter
2020-07-27 14:46 ` Dan Carpenter
2020-07-27 15:30 ` Peilin Ye
2020-07-27 15:30 ` Peilin Ye
2020-07-27 14:43 ` Dan Carpenter
2020-07-27 14:43 ` Dan Carpenter
2020-07-27 14:55 ` Arnd Bergmann
2020-07-27 14:55 ` Arnd Bergmann
2020-07-27 22:04 ` Peilin Ye
2020-07-27 22:04 ` Peilin Ye
2020-07-28 9:00 ` Arnd Bergmann
2020-07-28 9:00 ` Arnd Bergmann
2020-07-28 10:02 ` Dan Carpenter
2020-07-28 10:02 ` Dan Carpenter
2020-07-27 22:33 ` Peilin Ye
2020-07-27 22:33 ` Peilin Ye
2020-07-28 9:10 ` Arnd Bergmann
2020-07-28 9:10 ` Arnd Bergmann
2020-07-28 9:47 ` Dan Carpenter
2020-07-28 9:47 ` Dan Carpenter
2020-07-28 13:13 ` Peilin Ye
2020-07-28 13:13 ` Peilin Ye
2020-07-28 12:22 ` Linus Walleij
2020-07-28 12:22 ` Linus Walleij
2020-07-28 13:06 ` Dan Carpenter
2020-07-28 13:06 ` Dan Carpenter
2020-07-28 13:58 ` Arnd Bergmann
2020-07-28 13:58 ` Arnd Bergmann
2020-07-30 8:07 ` Bartosz Golaszewski
2020-07-30 8:07 ` Bartosz Golaszewski
2020-07-30 8:15 ` Arnd Bergmann
2020-07-30 8:15 ` Arnd Bergmann
2020-07-30 8:38 ` Andy Shevchenko
2020-07-30 8:38 ` Andy Shevchenko
2020-07-30 9:18 ` Arnd Bergmann
2020-07-30 9:18 ` Arnd Bergmann
2020-07-30 11:48 ` Andy Shevchenko
2020-07-30 11:48 ` Andy Shevchenko
2020-07-30 13:49 ` Arnd Bergmann
2020-07-30 13:49 ` Arnd Bergmann
2020-08-02 16:55 ` Peilin Ye
2020-08-02 16:55 ` Peilin Ye
2020-07-27 8:00 ` [Linux-kernel-mentees] [PATCH v4] " Peilin Ye
2020-07-27 8:00 ` Peilin Ye
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAK8P3a3NB2BVo9fH-Wcinrhhs-QJ=9dK59Ds83TvgLmEkRy3qA@mail.gmail.com' \
--to=arnd@arndb.de \
--cc=bnvandana@gmail.com \
--cc=ezequiel@collabora.com \
--cc=gregkh@linuxfoundation.org \
--cc=hverkuil-cisco@xs4all.nl \
--cc=laurent.pinchart@ideasonboard.com \
--cc=linux-kernel-mentees@lists.linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab@kernel.org \
--cc=niklas.soderlund+renesas@ragnatech.se \
--cc=sakari.ailus@linux.intel.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=yepeilin.cs@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.