* [[PATCH]] vb2: verify data_offset only if nonzero bytesused
@ 2014-06-22 10:47 Nikhil Devshatwar
2014-06-23 7:55 ` Hans Verkuil
0 siblings, 1 reply; 3+ messages in thread
From: Nikhil Devshatwar @ 2014-06-22 10:47 UTC (permalink / raw)
To: linux-media; +Cc: Nikhil Devshatwar
verify_planes would fail if the user space fills up the data_offset field
and bytesused is left as zero. Correct this.
Checking for data_offset > bytesused is not correct as it might fail some of
the valid use cases. e.g. when working with SEQ_TB buffers, for bottom field,
data_offset can be high but it can have less bytesused.
The real check should be to verify that all the bytesused after data_offset
fit withing the length of the plane.
Signed-off-by: Nikhil Devshatwar <nikhil.nd@ti.com>
---
drivers/media/v4l2-core/videobuf2-core.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
index 7c4489c..9a0ccb6 100644
--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -587,12 +587,9 @@ static int __verify_length(struct vb2_buffer *vb, const struct v4l2_buffer *b)
? b->m.planes[plane].length
: vb->v4l2_planes[plane].length;
- if (b->m.planes[plane].bytesused > length)
- return -EINVAL;
-
- if (b->m.planes[plane].data_offset > 0 &&
- b->m.planes[plane].data_offset >=
- b->m.planes[plane].bytesused)
+ if (b->m.planes[plane].bytesused > 0 &&
+ b->m.planes[plane].data_offset +
+ b->m.planes[plane].bytesused > length)
return -EINVAL;
}
} else {
--
1.7.9.5
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [[PATCH]] vb2: verify data_offset only if nonzero bytesused
2014-06-22 10:47 [[PATCH]] vb2: verify data_offset only if nonzero bytesused Nikhil Devshatwar
@ 2014-06-23 7:55 ` Hans Verkuil
2014-06-23 9:42 ` Devshatwar, Nikhil
0 siblings, 1 reply; 3+ messages in thread
From: Hans Verkuil @ 2014-06-23 7:55 UTC (permalink / raw)
To: Nikhil Devshatwar, linux-media
On 06/22/2014 12:47 PM, Nikhil Devshatwar wrote:
> verify_planes would fail if the user space fills up the data_offset field
> and bytesused is left as zero. Correct this.
>
> Checking for data_offset > bytesused is not correct as it might fail some of
> the valid use cases. e.g. when working with SEQ_TB buffers, for bottom field,
> data_offset can be high but it can have less bytesused.
>
> The real check should be to verify that all the bytesused after data_offset
> fit withing the length of the plane.
>
> Signed-off-by: Nikhil Devshatwar <nikhil.nd@ti.com>
> ---
> drivers/media/v4l2-core/videobuf2-core.c | 9 +++------
> 1 file changed, 3 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
> index 7c4489c..9a0ccb6 100644
> --- a/drivers/media/v4l2-core/videobuf2-core.c
> +++ b/drivers/media/v4l2-core/videobuf2-core.c
> @@ -587,12 +587,9 @@ static int __verify_length(struct vb2_buffer *vb, const struct v4l2_buffer *b)
> ? b->m.planes[plane].length
> : vb->v4l2_planes[plane].length;
>
> - if (b->m.planes[plane].bytesused > length)
> - return -EINVAL;
> -
> - if (b->m.planes[plane].data_offset > 0 &&
> - b->m.planes[plane].data_offset >=
> - b->m.planes[plane].bytesused)
> + if (b->m.planes[plane].bytesused > 0 &&
> + b->m.planes[plane].data_offset +
> + b->m.planes[plane].bytesused > length)
Nacked-by: Hans Verkuil <hans.verkuil@cisco.com>
bytesused *includes* data_offset. So the effective payload is
'bytesused - data_offset' starting at offset 'data_offset' from the
start of the buffer.
So your new condition is wrong.
Regards,
Hans
> return -EINVAL;
> }
> } else {
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [[PATCH]] vb2: verify data_offset only if nonzero bytesused
2014-06-23 7:55 ` Hans Verkuil
@ 2014-06-23 9:42 ` Devshatwar, Nikhil
0 siblings, 0 replies; 3+ messages in thread
From: Devshatwar, Nikhil @ 2014-06-23 9:42 UTC (permalink / raw)
To: Hans Verkuil, linux-media
On Monday 23 June 2014 01:25 PM, Hans Verkuil wrote:
> On 06/22/2014 12:47 PM, Nikhil Devshatwar wrote:
>> verify_planes would fail if the user space fills up the data_offset field
>> and bytesused is left as zero. Correct this.
>>
>> Checking for data_offset > bytesused is not correct as it might fail some of
>> the valid use cases. e.g. when working with SEQ_TB buffers, for bottom field,
>> data_offset can be high but it can have less bytesused.
>>
>> The real check should be to verify that all the bytesused after data_offset
>> fit withing the length of the plane.
>>
>> Signed-off-by: Nikhil Devshatwar <nikhil.nd@ti.com>
>> ---
>> drivers/media/v4l2-core/videobuf2-core.c | 9 +++------
>> 1 file changed, 3 insertions(+), 6 deletions(-)
>>
>> diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
>> index 7c4489c..9a0ccb6 100644
>> --- a/drivers/media/v4l2-core/videobuf2-core.c
>> +++ b/drivers/media/v4l2-core/videobuf2-core.c
>> @@ -587,12 +587,9 @@ static int __verify_length(struct vb2_buffer *vb, const struct v4l2_buffer *b)
>> ? b->m.planes[plane].length
>> : vb->v4l2_planes[plane].length;
>>
>> - if (b->m.planes[plane].bytesused > length)
>> - return -EINVAL;
>> -
>> - if (b->m.planes[plane].data_offset > 0 &&
>> - b->m.planes[plane].data_offset >=
>> - b->m.planes[plane].bytesused)
>> + if (b->m.planes[plane].bytesused > 0 &&
>> + b->m.planes[plane].data_offset +
>> + b->m.planes[plane].bytesused > length)
> Nacked-by: Hans Verkuil <hans.verkuil@cisco.com>
>
> bytesused *includes* data_offset. So the effective payload is
> 'bytesused - data_offset' starting at offset 'data_offset' from the
> start of the buffer.
Ohh! I misinterpreted bytesused field
I Will correct the condition
> So your new condition is wrong.
>
> Regards,
>
> Hans
>
>> return -EINVAL;
>> }
>> } else {
>>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2014-06-23 9:43 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-06-22 10:47 [[PATCH]] vb2: verify data_offset only if nonzero bytesused Nikhil Devshatwar
2014-06-23 7:55 ` Hans Verkuil
2014-06-23 9:42 ` Devshatwar, Nikhil
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).