linux-kernel-mentees.lists.linuxfoundation.org archive mirror
 help / color / mirror / Atom feed
From: Peilin Ye <yepeilin.cs@gmail.com>
To: Hans Verkuil <hverkuil@xs4all.nl>
Cc: syzkaller-bugs@googlegroups.com,
	linux-kernel-mentees@lists.linuxfoundation.org,
	linux-kernel@vger.kernel.org, linux-media@vger.kernel.org
Subject: Re: [Linux-kernel-mentees] [PATCH] v4l2-tpg: Fix global-out-of-bounds read in precalculate_color()
Date: Fri, 21 Aug 2020 06:26:14 -0400	[thread overview]
Message-ID: <20200821102614.GA490417@PWN> (raw)
In-Reply-To: <eab860f3-5520-72cd-3bb1-f990f7f9ea6f@xs4all.nl>

On Fri, Aug 21, 2020 at 12:12:28PM +0200, Hans Verkuil wrote:
> Arrgh! I know what this is. /dev/video6 corresponds to the Metadata output
> device of vivid, and that metadata format sets brightness, contrast,
> saturation and hue:
> 
> struct vivid_meta_out_buf {
>         u16     brightness;
>         u16     contrast;
>         u16     saturation;
>         s16     hue;
> };
> 
> vivid_meta_out_process() calls tpg_s_* functions to set these values. But
> this is wrong, it should set the corresponding V4L2 controls instead since
> calling these tpg_s_* functions bypasses all range checks. It also will
> not update the controls themselves, so they are out-of-sync with the actual
> values. I.e. the test pattern generator uses different values compared to
> the values in the controls.
> 
> So two patches are needed:
> 
> 1) a patch for include/media/tpg/v4l2-tpg.h where tpg_s_hue will clamp the
> hue value to the valid range. This to prevent anyone else from setting invalid
> hue values in the tpg.
> 
> 2) a patch for drivers/media/test-drivers/vivid/vivid-meta-out.c where,
> instead of calling the tpg_s_* functions in vivid_meta_out_process(), it
> calls instead:
> 
>         v4l2_ctrl_s_ctrl(dev->brightness, meta->brightness);
>         v4l2_ctrl_s_ctrl(dev->contrast, meta->contrast);
> 	etc.
> 
> Do patch 2 first and test with syzkaller to check that by going through the
> controls this issue is resolved. Since with that approach the tpg should
> always get valid hue values.

Ah, now it all makes sense! Thank you! I will do them now.

Peilin
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees

  reply	other threads:[~2020-08-21 10:26 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-08-10  5:05 [Linux-kernel-mentees] [PATCH] v4l2-tpg: Fix global-out-of-bounds read in precalculate_color() Peilin Ye
2020-08-19 14:26 ` Hans Verkuil
2020-08-19 15:16   ` Peilin Ye
2020-08-21  9:48   ` Peilin Ye
2020-08-21 10:12     ` Hans Verkuil
2020-08-21 10:26       ` Peilin Ye [this message]
2020-08-21 12:46 ` [Linux-kernel-mentees] [PATCH v2] vivid: " Peilin Ye

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200821102614.GA490417@PWN \
    --to=yepeilin.cs@gmail.com \
    --cc=hverkuil@xs4all.nl \
    --cc=linux-kernel-mentees@lists.linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-media@vger.kernel.org \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).