* [PATCH] media: videobuf2: Fix integer overrun in vb2_mmap
@ 2021-03-10 7:40 Ricardo Ribalda
2021-03-10 7:46 ` Sergey Senozhatsky
2021-03-10 7:47 ` Jiri Slaby
0 siblings, 2 replies; 4+ messages in thread
From: Ricardo Ribalda @ 2021-03-10 7:40 UTC (permalink / raw)
To: Tomasz Figa, Marek Szyprowski, linux-media, linux-kernel
Cc: Ricardo Ribalda, Sergey Senozhatsky, stable
The plane_length is an unsigned integer. So, if we have a size of
0xffffffff bytes we incorrectly allocate 0 bytes instead of 1 << 32.
Suggested-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Cc: stable@vger.kernel.org
Fixes: 7f8414594e47 ("[media] media: videobuf2: fix the length check for mmap")
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
---
drivers/media/common/videobuf2/videobuf2-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c
index 543da515c761..876db5886867 100644
--- a/drivers/media/common/videobuf2/videobuf2-core.c
+++ b/drivers/media/common/videobuf2/videobuf2-core.c
@@ -2256,7 +2256,7 @@ int vb2_mmap(struct vb2_queue *q, struct vm_area_struct *vma)
* The buffer length was page_aligned at __vb2_buf_mem_alloc(),
* so, we need to do the same here.
*/
- length = PAGE_ALIGN(vb->planes[plane].length);
+ length = PAGE_ALIGN((unsigned int)vb->planes[plane].length);
if (length < (vma->vm_end - vma->vm_start)) {
dprintk(q, 1,
"MMAP invalid, as it would overflow buffer length\n");
--
2.30.1.766.gb4fecdf3b7-goog
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] media: videobuf2: Fix integer overrun in vb2_mmap
2021-03-10 7:40 [PATCH] media: videobuf2: Fix integer overrun in vb2_mmap Ricardo Ribalda
@ 2021-03-10 7:46 ` Sergey Senozhatsky
2021-03-10 7:47 ` Jiri Slaby
1 sibling, 0 replies; 4+ messages in thread
From: Sergey Senozhatsky @ 2021-03-10 7:46 UTC (permalink / raw)
To: Ricardo Ribalda
Cc: Tomasz Figa, Marek Szyprowski, linux-media, linux-kernel,
Sergey Senozhatsky, stable
On (21/03/10 08:40), Ricardo Ribalda wrote:
>
> The plane_length is an unsigned integer. So, if we have a size of
> 0xffffffff bytes we incorrectly allocate 0 bytes instead of 1 << 32.
>
> Suggested-by: Sergey Senozhatsky <senozhatsky@chromium.org>
> Cc: stable@vger.kernel.org
> Fixes: 7f8414594e47 ("[media] media: videobuf2: fix the length check for mmap")
> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
FWIF,
Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] media: videobuf2: Fix integer overrun in vb2_mmap
2021-03-10 7:40 [PATCH] media: videobuf2: Fix integer overrun in vb2_mmap Ricardo Ribalda
2021-03-10 7:46 ` Sergey Senozhatsky
@ 2021-03-10 7:47 ` Jiri Slaby
2021-03-10 7:49 ` Ricardo Ribalda
1 sibling, 1 reply; 4+ messages in thread
From: Jiri Slaby @ 2021-03-10 7:47 UTC (permalink / raw)
To: Ricardo Ribalda, Tomasz Figa, Marek Szyprowski, linux-media,
linux-kernel
Cc: Sergey Senozhatsky, stable
On 10. 03. 21, 8:40, Ricardo Ribalda wrote:
> The plane_length is an unsigned integer. So, if we have a size of
> 0xffffffff bytes we incorrectly allocate 0 bytes instead of 1 << 32.
>
> Suggested-by: Sergey Senozhatsky <senozhatsky@chromium.org>
> Cc: stable@vger.kernel.org
> Fixes: 7f8414594e47 ("[media] media: videobuf2: fix the length check for mmap")
> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
> ---
> drivers/media/common/videobuf2/videobuf2-core.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c
> index 543da515c761..876db5886867 100644
> --- a/drivers/media/common/videobuf2/videobuf2-core.c
> +++ b/drivers/media/common/videobuf2/videobuf2-core.c
> @@ -2256,7 +2256,7 @@ int vb2_mmap(struct vb2_queue *q, struct vm_area_struct *vma)
> * The buffer length was page_aligned at __vb2_buf_mem_alloc(),
> * so, we need to do the same here.
> */
> - length = PAGE_ALIGN(vb->planes[plane].length);
> + length = PAGE_ALIGN((unsigned int)vb->planes[plane].length);
Hi,
I fail to see how case from uint to uint helps -- IOW, did you mean ulong?
regards,
--
js
suse labs
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] media: videobuf2: Fix integer overrun in vb2_mmap
2021-03-10 7:47 ` Jiri Slaby
@ 2021-03-10 7:49 ` Ricardo Ribalda
0 siblings, 0 replies; 4+ messages in thread
From: Ricardo Ribalda @ 2021-03-10 7:49 UTC (permalink / raw)
To: Jiri Slaby
Cc: Tomasz Figa, Marek Szyprowski, Linux Media Mailing List,
Linux Kernel Mailing List, Sergey Senozhatsky, stable
On Wed, Mar 10, 2021 at 8:47 AM Jiri Slaby <jslaby@suse.cz> wrote:
>
> On 10. 03. 21, 8:40, Ricardo Ribalda wrote:
> > The plane_length is an unsigned integer. So, if we have a size of
> > 0xffffffff bytes we incorrectly allocate 0 bytes instead of 1 << 32.
> >
> > Suggested-by: Sergey Senozhatsky <senozhatsky@chromium.org>
> > Cc: stable@vger.kernel.org
> > Fixes: 7f8414594e47 ("[media] media: videobuf2: fix the length check for mmap")
> > Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
> > ---
> > drivers/media/common/videobuf2/videobuf2-core.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c
> > index 543da515c761..876db5886867 100644
> > --- a/drivers/media/common/videobuf2/videobuf2-core.c
> > +++ b/drivers/media/common/videobuf2/videobuf2-core.c
> > @@ -2256,7 +2256,7 @@ int vb2_mmap(struct vb2_queue *q, struct vm_area_struct *vma)
> > * The buffer length was page_aligned at __vb2_buf_mem_alloc(),
> > * so, we need to do the same here.
> > */
> > - length = PAGE_ALIGN(vb->planes[plane].length);
> > + length = PAGE_ALIGN((unsigned int)vb->planes[plane].length);
>
> Hi,
>
> I fail to see how case from uint to uint helps -- IOW, did you mean ulong?
Ups... my bad :(
Let me send a v2
>
> regards,
> --
> js
> suse labs
--
Ricardo Ribalda
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-03-10 7:50 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-03-10 7:40 [PATCH] media: videobuf2: Fix integer overrun in vb2_mmap Ricardo Ribalda
2021-03-10 7:46 ` Sergey Senozhatsky
2021-03-10 7:47 ` Jiri Slaby
2021-03-10 7:49 ` Ricardo Ribalda
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).