From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0025FC43331 for ; Fri, 5 Mar 2021 13:56:51 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id CC09C65026 for ; Fri, 5 Mar 2021 13:56:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231176AbhCEN40 (ORCPT ); Fri, 5 Mar 2021 08:56:26 -0500 Received: from mail.kernel.org ([198.145.29.99]:58946 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233702AbhCEMmT (ORCPT ); Fri, 5 Mar 2021 07:42:19 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id CF07C6501E; Fri, 5 Mar 2021 12:42:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1614948139; bh=WYcOdaPInSYEuY4UveYO3WT1u99GFyMsfnKr+Qa1lPg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uq+NA9e+FE+cszE4h0PLnHCLfZLPnXi8ywGcdO85LGVuv4d1BKaYUz86Pch09GaYV 8C6q9pIp8hHxteOgRgzeakOQNW4GPVE8eZMKf9rpUS4XWIER8SFzm0quWbgu27RHBM pcVXM1FMAm3FO9xvYTjFKWc6uGvMhbmIUnh93YTk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Arnd Bergmann , syzbot+1115e79c8df6472c612b@syzkaller.appspotmail.com, Sakari Ailus , Arnd Bergmann , Hans Verkuil , Laurent Pinchart , Mauro Carvalho Chehab Subject: [PATCH 4.9 41/41] media: v4l: ioctl: Fix memory leak in video_usercopy Date: Fri, 5 Mar 2021 13:22:48 +0100 Message-Id: <20210305120853.312724479@linuxfoundation.org> X-Mailer: git-send-email 2.30.1 In-Reply-To: <20210305120851.255002428@linuxfoundation.org> References: <20210305120851.255002428@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Sakari Ailus commit fb18802a338b36f675a388fc03d2aa504a0d0899 upstream. When an IOCTL with argument size larger than 128 that also used array arguments were handled, two memory allocations were made but alas, only the latter one of them was released. This happened because there was only a single local variable to hold such a temporary allocation. Fix this by adding separate variables to hold the pointers to the temporary allocations. Reported-by: Arnd Bergmann Reported-by: syzbot+1115e79c8df6472c612b@syzkaller.appspotmail.com Fixes: d14e6d76ebf7 ("[media] v4l: Add multi-planar ioctl handling code") Cc: stable@vger.kernel.org Signed-off-by: Sakari Ailus Acked-by: Arnd Bergmann Acked-by: Hans Verkuil Reviewed-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman --- drivers/media/v4l2-core/v4l2-ioctl.c | 19 +++++++------------ 1 file changed, 7 insertions(+), 12 deletions(-) --- a/drivers/media/v4l2-core/v4l2-ioctl.c +++ b/drivers/media/v4l2-core/v4l2-ioctl.c @@ -2804,7 +2804,7 @@ video_usercopy(struct file *file, unsign v4l2_kioctl func) { char sbuf[128]; - void *mbuf = NULL; + void *mbuf = NULL, *array_buf = NULL; void *parg = (void *)arg; long err = -EINVAL; bool has_array_args; @@ -2859,20 +2859,14 @@ video_usercopy(struct file *file, unsign has_array_args = err; if (has_array_args) { - /* - * When adding new types of array args, make sure that the - * parent argument to ioctl (which contains the pointer to the - * array) fits into sbuf (so that mbuf will still remain - * unused up to here). - */ - mbuf = kmalloc(array_size, GFP_KERNEL); + array_buf = kmalloc(array_size, GFP_KERNEL); err = -ENOMEM; - if (NULL == mbuf) + if (array_buf == NULL) goto out_array_args; err = -EFAULT; - if (copy_from_user(mbuf, user_ptr, array_size)) + if (copy_from_user(array_buf, user_ptr, array_size)) goto out_array_args; - *kernel_ptr = mbuf; + *kernel_ptr = array_buf; } /* Handles IOCTL */ @@ -2891,7 +2885,7 @@ video_usercopy(struct file *file, unsign if (has_array_args) { *kernel_ptr = (void __force *)user_ptr; - if (copy_to_user(user_ptr, mbuf, array_size)) + if (copy_to_user(user_ptr, array_buf, array_size)) err = -EFAULT; goto out_array_args; } @@ -2911,6 +2905,7 @@ out_array_args: } out: + kfree(array_buf); kfree(mbuf); return err; }