* [PATCH] media: v4l2-flash: fix NULL dereference in v4l2_flash_s_ctrl()
@ 2022-12-07 14:18 Aleksandr Burakov
2022-12-07 14:18 ` [PATCH 2/2] misc: genwqe: card_dev: Array index overflow fix in ddcb_cmd_fixups() Aleksandr Burakov
2023-01-16 21:01 ` [PATCH] media: v4l2-flash: fix NULL dereference in v4l2_flash_s_ctrl() Sakari Ailus
0 siblings, 2 replies; 6+ messages in thread
From: Aleksandr Burakov @ 2022-12-07 14:18 UTC (permalink / raw)
To: Mauro Carvalho Chehab
Cc: Aleksandr Burakov, linux-media, linux-kernel, lvc-project
The NULL check added for fled_cdev before dereference.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Aleksandr Burakov <a.burakov@rosalinux.ru>
Fixes: 42bd6f59ae90 ("media: Add registration helpers for V4L2 flash sub-devices")
---
drivers/media/v4l2-core/v4l2-flash-led-class.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/media/v4l2-core/v4l2-flash-led-class.c b/drivers/media/v4l2-core/v4l2-flash-led-class.c
index 355595a0fefa..36cc46e80eea 100644
--- a/drivers/media/v4l2-core/v4l2-flash-led-class.c
+++ b/drivers/media/v4l2-core/v4l2-flash-led-class.c
@@ -291,12 +291,16 @@ static int v4l2_flash_s_ctrl(struct v4l2_ctrl *c)
* No conversion is needed as LED Flash class also uses
* microseconds for flash timeout units.
*/
+ if (!fled_cdev)
+ return -EINVAL;
return led_set_flash_timeout(fled_cdev, c->val);
case V4L2_CID_FLASH_INTENSITY:
/*
* No conversion is needed as LED Flash class also uses
* microamperes for flash intensity units.
*/
+ if (!fled_cdev)
+ return -EINVAL;
return led_set_flash_brightness(fled_cdev, c->val);
}
--
2.25.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 2/2] misc: genwqe: card_dev: Array index overflow fix in ddcb_cmd_fixups()
2022-12-07 14:18 [PATCH] media: v4l2-flash: fix NULL dereference in v4l2_flash_s_ctrl() Aleksandr Burakov
@ 2022-12-07 14:18 ` Aleksandr Burakov
2022-12-07 16:23 ` Greg Kroah-Hartman
2023-01-16 21:01 ` [PATCH] media: v4l2-flash: fix NULL dereference in v4l2_flash_s_ctrl() Sakari Ailus
1 sibling, 1 reply; 6+ messages in thread
From: Aleksandr Burakov @ 2022-12-07 14:18 UTC (permalink / raw)
To: Frank Haverkamp, Arnd Bergmann, Greg Kroah-Hartman
Cc: Aleksandr Burakov, linux-kernel, lvc-project
&cmd->asiv of size 96 can overflow because its index (asiv_offs + 8)
can be equal to 96 (0x58 + 0x08) that is out of range.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Aleksandr Burakov <a.burakov@rosalinux.ru>
Fixes: eaf4722d4645 ("GenWQE Character device and DDCB queue")
---
drivers/misc/genwqe/card_dev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/misc/genwqe/card_dev.c b/drivers/misc/genwqe/card_dev.c
index 55fc5b80e649..d58ce2622307 100644
--- a/drivers/misc/genwqe/card_dev.c
+++ b/drivers/misc/genwqe/card_dev.c
@@ -867,7 +867,7 @@ static int ddcb_cmd_fixups(struct genwqe_file *cfile, struct ddcb_requ *req)
struct genwqe_ddcb_cmd *cmd = &req->cmd;
struct dma_mapping *m;
- for (i = 0, asiv_offs = 0x00; asiv_offs <= 0x58;
+ for (i = 0, asiv_offs = 0x00; asiv_offs < 0x58;
i++, asiv_offs += 0x08) {
u64 u_addr;
--
2.25.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH 2/2] misc: genwqe: card_dev: Array index overflow fix in ddcb_cmd_fixups()
2022-12-07 14:18 ` [PATCH 2/2] misc: genwqe: card_dev: Array index overflow fix in ddcb_cmd_fixups() Aleksandr Burakov
@ 2022-12-07 16:23 ` Greg Kroah-Hartman
2022-12-08 10:55 ` Александр Бураков
0 siblings, 1 reply; 6+ messages in thread
From: Greg Kroah-Hartman @ 2022-12-07 16:23 UTC (permalink / raw)
To: Aleksandr Burakov
Cc: Frank Haverkamp, Arnd Bergmann, linux-kernel, lvc-project
On Wed, Dec 07, 2022 at 05:18:08PM +0300, Aleksandr Burakov wrote:
> &cmd->asiv of size 96 can overflow because its index (asiv_offs + 8)
> can be equal to 96 (0x58 + 0x08) that is out of range.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Signed-off-by: Aleksandr Burakov <a.burakov@rosalinux.ru>
> Fixes: eaf4722d4645 ("GenWQE Character device and DDCB queue")
> ---
> drivers/misc/genwqe/card_dev.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/misc/genwqe/card_dev.c b/drivers/misc/genwqe/card_dev.c
> index 55fc5b80e649..d58ce2622307 100644
> --- a/drivers/misc/genwqe/card_dev.c
> +++ b/drivers/misc/genwqe/card_dev.c
> @@ -867,7 +867,7 @@ static int ddcb_cmd_fixups(struct genwqe_file *cfile, struct ddcb_requ *req)
> struct genwqe_ddcb_cmd *cmd = &req->cmd;
> struct dma_mapping *m;
>
> - for (i = 0, asiv_offs = 0x00; asiv_offs <= 0x58;
> + for (i = 0, asiv_offs = 0x00; asiv_offs < 0x58;
> i++, asiv_offs += 0x08) {
>
> u64 u_addr;
> --
> 2.25.1
>
Where is patch 1/2 of this series?
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 2/2] misc: genwqe: card_dev: Array index overflow fix in ddcb_cmd_fixups()
2022-12-07 16:23 ` Greg Kroah-Hartman
@ 2022-12-08 10:55 ` Александр Бураков
2022-12-08 13:16 ` Greg Kroah-Hartman
0 siblings, 1 reply; 6+ messages in thread
From: Александр Бураков @ 2022-12-08 10:55 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Frank Haverkamp, Arnd Bergmann, linux-kernel, lvc-project
Hello!
The subject was created this way due to technical issues. There is only one patch here.
With best regards,
A. Burakov
----- Исходное сообщение -----
От: "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>
Кому: "Александр Бураков" <a.burakov@rosalinux.ru>
Копия: "Frank Haverkamp" <haver@linux.ibm.com>, "Arnd Bergmann" <arnd@arndb.de>, linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org
Отправленные: Среда, 7 Декабрь 2022 г 19:23:12
Тема: Re: [PATCH 2/2] misc: genwqe: card_dev: Array index overflow fix in ddcb_cmd_fixups()
On Wed, Dec 07, 2022 at 05:18:08PM +0300, Aleksandr Burakov wrote:
> &cmd->asiv of size 96 can overflow because its index (asiv_offs + 8)
> can be equal to 96 (0x58 + 0x08) that is out of range.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Signed-off-by: Aleksandr Burakov <a.burakov@rosalinux.ru>
> Fixes: eaf4722d4645 ("GenWQE Character device and DDCB queue")
> ---
> drivers/misc/genwqe/card_dev.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/misc/genwqe/card_dev.c b/drivers/misc/genwqe/card_dev.c
> index 55fc5b80e649..d58ce2622307 100644
> --- a/drivers/misc/genwqe/card_dev.c
> +++ b/drivers/misc/genwqe/card_dev.c
> @@ -867,7 +867,7 @@ static int ddcb_cmd_fixups(struct genwqe_file *cfile, struct ddcb_requ *req)
> struct genwqe_ddcb_cmd *cmd = &req->cmd;
> struct dma_mapping *m;
>
> - for (i = 0, asiv_offs = 0x00; asiv_offs <= 0x58;
> + for (i = 0, asiv_offs = 0x00; asiv_offs < 0x58;
> i++, asiv_offs += 0x08) {
>
> u64 u_addr;
> --
> 2.25.1
>
Where is patch 1/2 of this series?
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 2/2] misc: genwqe: card_dev: Array index overflow fix in ddcb_cmd_fixups()
2022-12-08 10:55 ` Александр Бураков
@ 2022-12-08 13:16 ` Greg Kroah-Hartman
0 siblings, 0 replies; 6+ messages in thread
From: Greg Kroah-Hartman @ 2022-12-08 13:16 UTC (permalink / raw)
To: Александр
Бураков
Cc: Frank Haverkamp, Arnd Bergmann, linux-kernel, lvc-project
A: http://en.wikipedia.org/wiki/Top_post
Q: Were do I find info about this thing called top-posting?
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
A: Top-posting.
Q: What is the most annoying thing in e-mail?
A: No.
Q: Should I include quotations after my reply?
http://daringfireball.net/2007/07/on_top
On Thu, Dec 08, 2022 at 01:55:01PM +0300, Александр Бураков wrote:
> Hello!
>
> The subject was created this way due to technical issues. There is only one patch here.
Great, then please fix up those issues and resend a version 2 of this
patch, otherwise it confuses us all. Please remember that we optimize
for review, and as such, if you make a mistake like this, it's up to you
to fix it up, not us.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] media: v4l2-flash: fix NULL dereference in v4l2_flash_s_ctrl()
2022-12-07 14:18 [PATCH] media: v4l2-flash: fix NULL dereference in v4l2_flash_s_ctrl() Aleksandr Burakov
2022-12-07 14:18 ` [PATCH 2/2] misc: genwqe: card_dev: Array index overflow fix in ddcb_cmd_fixups() Aleksandr Burakov
@ 2023-01-16 21:01 ` Sakari Ailus
1 sibling, 0 replies; 6+ messages in thread
From: Sakari Ailus @ 2023-01-16 21:01 UTC (permalink / raw)
To: Aleksandr Burakov
Cc: Mauro Carvalho Chehab, linux-media, linux-kernel, lvc-project
Hi Alexandr,
On Wed, Dec 07, 2022 at 05:18:07PM +0300, Aleksandr Burakov wrote:
> The NULL check added for fled_cdev before dereference.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Signed-off-by: Aleksandr Burakov <a.burakov@rosalinux.ru>
> Fixes: 42bd6f59ae90 ("media: Add registration helpers for V4L2 flash sub-devices")
> ---
> drivers/media/v4l2-core/v4l2-flash-led-class.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/drivers/media/v4l2-core/v4l2-flash-led-class.c b/drivers/media/v4l2-core/v4l2-flash-led-class.c
> index 355595a0fefa..36cc46e80eea 100644
> --- a/drivers/media/v4l2-core/v4l2-flash-led-class.c
> +++ b/drivers/media/v4l2-core/v4l2-flash-led-class.c
> @@ -291,12 +291,16 @@ static int v4l2_flash_s_ctrl(struct v4l2_ctrl *c)
> * No conversion is needed as LED Flash class also uses
> * microseconds for flash timeout units.
> */
> + if (!fled_cdev)
> + return -EINVAL;
> return led_set_flash_timeout(fled_cdev, c->val);
> case V4L2_CID_FLASH_INTENSITY:
> /*
> * No conversion is needed as LED Flash class also uses
> * microamperes for flash intensity units.
> */
> + if (!fled_cdev)
> + return -EINVAL;
> return led_set_flash_brightness(fled_cdev, c->val);
> }
>
fled_cdev won't be NULL above, this is checked elsewhere in the V4L2 flash
LED class code. I guess the question then is whether doing such a check is
meaningful. It would require a bug elsewhere in the code to happen.
--
Kind regards,
Sakari Ailus
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2023-01-16 21:01 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-12-07 14:18 [PATCH] media: v4l2-flash: fix NULL dereference in v4l2_flash_s_ctrl() Aleksandr Burakov
2022-12-07 14:18 ` [PATCH 2/2] misc: genwqe: card_dev: Array index overflow fix in ddcb_cmd_fixups() Aleksandr Burakov
2022-12-07 16:23 ` Greg Kroah-Hartman
2022-12-08 10:55 ` Александр Бураков
2022-12-08 13:16 ` Greg Kroah-Hartman
2023-01-16 21:01 ` [PATCH] media: v4l2-flash: fix NULL dereference in v4l2_flash_s_ctrl() Sakari Ailus
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).