[GIT FIXES FOR v5.0] v4l2-ioctl: Clear only per-plane reserved fields

[GIT FIXES FOR v5.0] v4l2-ioctl: Clear only per-plane reserved fields

[Hans Verkuil]

Fix for a nasty little bug.

Thanks Thierry for finding this!

Regards,

	Hans

The following changes since commit 1e0d0a5fd38192f23304ea2fc2b531fea7c74247:

  media: s5p-mfc: fix incorrect bus assignment in virtual child device (2019-01-07 14:39:36 -0500)

are available in the Git repository at:

  git://linuxtv.org/hverkuil/media_tree.git tags/br-v5.0a

for you to fetch changes up to b8ee4a126c857638a4696b8b24b4c555ef7fedb7:

  media: v4l2-ioctl: Clear only per-plane reserved fields (2019-01-10 12:50:36 +0100)

----------------------------------------------------------------
Tag branch

----------------------------------------------------------------
Thierry Reding (1):
      media: v4l2-ioctl: Clear only per-plane reserved fields

 drivers/media/v4l2-core/v4l2-ioctl.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

[GIT FIXES FOR v5.0] v4l2-ioctl: Clear only per-plane reserved fields

[Hans Verkuil]

Three fixes for a bug introduced in 5.0.

The last patch (Validate num_planes for debug messages) is also backported
to kernels >= 4.12 (the oldest kernel for which it applies cleanly).

Regards,

	Hans


The following changes since commit 1e0d0a5fd38192f23304ea2fc2b531fea7c74247:

  media: s5p-mfc: fix incorrect bus assignment in virtual child device (2019-01-07 14:39:36 -0500)

are available in the Git repository at:

  git://linuxtv.org/hverkuil/media_tree.git tags/br-v5.0a2

for you to fetch changes up to 8015f0ce4a3c533acfbb3a71f0d6659fa4120778:

  v4l: ioctl: Validate num_planes for debug messages (2019-01-11 09:17:40 +0100)

----------------------------------------------------------------
Tag branch

----------------------------------------------------------------
Sakari Ailus (2):
      v4l: ioctl: Validate num_planes before using it
      v4l: ioctl: Validate num_planes for debug messages

Thierry Reding (1):
      media: v4l2-ioctl: Clear only per-plane reserved fields

 drivers/media/v4l2-core/v4l2-ioctl.c | 24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

Re: [GIT FIXES FOR v5.0] v4l2-ioctl: Clear only per-plane reserved fields

[Sakari Ailus]

Hi Hans,

On Fri, Jan 11, 2019 at 09:31:25AM +0100, Hans Verkuil wrote:
> Three fixes for a bug introduced in 5.0.
> 
> The last patch (Validate num_planes for debug messages) is also backported
> to kernels >= 4.12 (the oldest kernel for which it applies cleanly).

The surrounding lines of code have changed slightly over the years. The
older kernels still suffer from the same problem as far as I see, so the
backport is relevant down to 3.16 at least (but older kernels aren't
supported anyway so I didn't check further). The problem was likely
introduced by the big IOCTL handling patches long, long time ago. Huh.

-- 
Regards,

Sakari Ailus
sakari.ailus@linux.intel.com

Re: [GIT FIXES FOR v5.0] v4l2-ioctl: Clear only per-plane reserved fields

[Hans Verkuil]

On 1/11/19 10:10 PM, Sakari Ailus wrote:
> Hi Hans,
> 
> On Fri, Jan 11, 2019 at 09:31:25AM +0100, Hans Verkuil wrote:
>> Three fixes for a bug introduced in 5.0.
>>
>> The last patch (Validate num_planes for debug messages) is also backported
>> to kernels >= 4.12 (the oldest kernel for which it applies cleanly).
> 
> The surrounding lines of code have changed slightly over the years. The
> older kernels still suffer from the same problem as far as I see, so the
> backport is relevant down to 3.16 at least (but older kernels aren't
> supported anyway so I didn't check further). The problem was likely
> introduced by the big IOCTL handling patches long, long time ago. Huh.
> 

I didn't plan on backporting this to older kernels. You have to be root
to enable this debugging, so it is not security bug.

Regards,

	Hans

Re: [GIT FIXES FOR v5.0] v4l2-ioctl: Clear only per-plane reserved fields

[Sakari Ailus]

On Sat, Jan 12, 2019 at 10:17:47AM +0100, Hans Verkuil wrote:
> On 1/11/19 10:10 PM, Sakari Ailus wrote:
> > Hi Hans,
> > 
> > On Fri, Jan 11, 2019 at 09:31:25AM +0100, Hans Verkuil wrote:
> >> Three fixes for a bug introduced in 5.0.
> >>
> >> The last patch (Validate num_planes for debug messages) is also backported
> >> to kernels >= 4.12 (the oldest kernel for which it applies cleanly).
> > 
> > The surrounding lines of code have changed slightly over the years. The
> > older kernels still suffer from the same problem as far as I see, so the
> > backport is relevant down to 3.16 at least (but older kernels aren't
> > supported anyway so I didn't check further). The problem was likely
> > introduced by the big IOCTL handling patches long, long time ago. Huh.
> > 
> 
> I didn't plan on backporting this to older kernels. You have to be root
> to enable this debugging, so it is not security bug.

It is a security problem, even if root would have to enable the feature.

In practice it is not that severe as few would end up doing that. But we
don't know. I think it'd be easier to fix it than informing potential users
about its dangers.

I can submit a patch for the older kernels, too.

-- 
Sakari Ailus
sakari.ailus@linux.intel.com