Linux-Media Archive on lore.kernel.org
 help / Atom feed
* [PATCH 1/1] v4l: ioctl: Validate num_planes for debug messages
@ 2019-01-10 14:24 Sakari Ailus
  2019-01-10 15:42 ` Thierry Reding
       [not found] ` <20190116133554.E22672086D@mail.kernel.org>
  0 siblings, 2 replies; 3+ messages in thread
From: Sakari Ailus @ 2019-01-10 14:24 UTC (permalink / raw)
  To: linux-media; +Cc: hverkuil, Thierry Reding, Ezequiel Garcia

The num_planes field in struct v4l2_pix_format_mplane is used in a loop
before validating it. As the use is printing a debug message in this case,
just cap the value to the maximum allowed.

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Cc: stable@vger.kernel.org
---
 drivers/media/v4l2-core/v4l2-ioctl.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
index 3e57fa073b885..0e15b14055e5f 100644
--- a/drivers/media/v4l2-core/v4l2-ioctl.c
+++ b/drivers/media/v4l2-core/v4l2-ioctl.c
@@ -287,6 +287,7 @@ static void v4l_print_format(const void *arg, bool write_only)
 	const struct v4l2_window *win;
 	const struct v4l2_sdr_format *sdr;
 	const struct v4l2_meta_format *meta;
+	u32 planes;
 	unsigned i;
 
 	pr_cont("type=%s", prt_names(p->type, v4l2_type_names));
@@ -317,7 +318,8 @@ static void v4l_print_format(const void *arg, bool write_only)
 			prt_names(mp->field, v4l2_field_names),
 			mp->colorspace, mp->num_planes, mp->flags,
 			mp->ycbcr_enc, mp->quantization, mp->xfer_func);
-		for (i = 0; i < mp->num_planes; i++)
+		planes = min_t(u32, mp->num_planes, VIDEO_MAX_PLANES);
+		for (i = 0; i < planes; i++)
 			printk(KERN_DEBUG "plane %u: bytesperline=%u sizeimage=%u\n", i,
 					mp->plane_fmt[i].bytesperline,
 					mp->plane_fmt[i].sizeimage);
-- 
2.11.0


^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH 1/1] v4l: ioctl: Validate num_planes for debug messages
  2019-01-10 14:24 [PATCH 1/1] v4l: ioctl: Validate num_planes for debug messages Sakari Ailus
@ 2019-01-10 15:42 ` Thierry Reding
       [not found] ` <20190116133554.E22672086D@mail.kernel.org>
  1 sibling, 0 replies; 3+ messages in thread
From: Thierry Reding @ 2019-01-10 15:42 UTC (permalink / raw)
  To: Sakari Ailus; +Cc: linux-media, hverkuil, Ezequiel Garcia

[-- Attachment #1: Type: text/plain, Size: 539 bytes --]

On Thu, Jan 10, 2019 at 04:24:26PM +0200, Sakari Ailus wrote:
> The num_planes field in struct v4l2_pix_format_mplane is used in a loop
> before validating it. As the use is printing a debug message in this case,
> just cap the value to the maximum allowed.
> 
> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
> Cc: stable@vger.kernel.org
> ---
>  drivers/media/v4l2-core/v4l2-ioctl.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)

Seems reasonable:

Reviewed-by: Thierry Reding <treding@nvidia.com>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH 1/1] v4l: ioctl: Validate num_planes for debug messages
       [not found] ` <20190116133554.E22672086D@mail.kernel.org>
@ 2019-01-16 13:59   ` Hans Verkuil
  0 siblings, 0 replies; 3+ messages in thread
From: Hans Verkuil @ 2019-01-16 13:59 UTC (permalink / raw)
  To: Sasha Levin, Sakari Ailus, linux-media; +Cc: Thierry Reding, stable

On 1/16/19 2:35 PM, Sasha Levin wrote:
> Hi,
> 
> [This is an automated email]
> 
> This commit has been processed because it contains a -stable tag.
> The stable tag indicates that it's relevant for the following trees: all
> 
> The bot has tested the following trees: v4.20.2, v4.19.15, v4.14.93, v4.9.150, v4.4.170, v3.18.132.
> 
> v4.20.2: Build OK!
> v4.19.15: Build OK!
> v4.14.93: Build OK!
> v4.9.150: Failed to apply! Possible dependencies:
>     fb9ffa6a7f7e ("[media] v4l: Add metadata buffer type and format")
> 
> v4.4.170: Failed to apply! Possible dependencies:
>     0579e6e3a326 ("doc-rst: linux_tv: remove whitespaces")
>     17defc282fe6 ("Documentation: add meta-documentation for Sphinx and kernel-doc")
>     22cba31bae9d ("Documentation/sphinx: add basic working Sphinx configuration and build")
>     234d549662a7 ("doc-rst: video: use reference for VIDIOC_ENUMINPUT")
>     5377d91f3e88 ("doc-rst: linux_tv DocBook to reST migration (docs-next)")
>     7347081e8a52 ("doc-rst: linux_tv: simplify references")
>     789818845202 ("doc-rst: audio: Fix some cross references")
>     94fff0dc5333 ("doc-rst: dmx_fcalls: improve man-like format")
>     9e00ffca8cc7 ("doc-rst: querycap: fix troubles on some references")
>     af4a4d0db8ab ("doc-rst: linux_tv: Replace reference names to match ioctls")
>     c2b66cafdf02 ("[media] v4l: doc: Remove row numbers from tables")
>     e6702ee18e24 ("doc-rst: app-pri: Fix a bad reference")
>     fb9ffa6a7f7e ("[media] v4l: Add metadata buffer type and format")
> 
> v3.18.132: Failed to apply! Possible dependencies:
>     0579e6e3a326 ("doc-rst: linux_tv: remove whitespaces")
>     17defc282fe6 ("Documentation: add meta-documentation for Sphinx and kernel-doc")
>     22cba31bae9d ("Documentation/sphinx: add basic working Sphinx configuration and build")
>     5377d91f3e88 ("doc-rst: linux_tv DocBook to reST migration (docs-next)")
>     5699f871d2d5 ("scripts/kernel-doc: Adding cross-reference links to html documentation.")
>     7347081e8a52 ("doc-rst: linux_tv: simplify references")
>     af4a4d0db8ab ("doc-rst: linux_tv: Replace reference names to match ioctls")
>     b479bfd00e46 ("DocBook: Use a fixed encoding for output")
>     c2b66cafdf02 ("[media] v4l: doc: Remove row numbers from tables")
>     e6702ee18e24 ("doc-rst: app-pri: Fix a bad reference")
>     fb9ffa6a7f7e ("[media] v4l: Add metadata buffer type and format")
> 
> 
> How should we proceed with this patch?

The Cc to stable of this patch in the pending pull request has a 'for v4.12 and up':

https://git.linuxtv.org/hverkuil/media_tree.git/commit/?h=for-v5.0a&id=8015f0ce4a3c533acfbb3a71f0d6659fa4120778

So no need to patch pre-4.12 kernels.

Regards,

	Hans

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, back to index

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-01-10 14:24 [PATCH 1/1] v4l: ioctl: Validate num_planes for debug messages Sakari Ailus
2019-01-10 15:42 ` Thierry Reding
     [not found] ` <20190116133554.E22672086D@mail.kernel.org>
2019-01-16 13:59   ` Hans Verkuil

Linux-Media Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-media/0 linux-media/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-media linux-media/ https://lore.kernel.org/linux-media \
		linux-media@vger.kernel.org linux-media@archiver.kernel.org
	public-inbox-index linux-media


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-media


AGPL code for this site: git clone https://public-inbox.org/ public-inbox