lkml.org 
[lkml]   [2023]   [Mar]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.15 07/50] media: uvcvideo: Silence memcpy() run-time false positive warnings
    Date
    From: Kees Cook <keescook@chromium.org>

    [ Upstream commit b839212988575c701aab4d3d9ca15e44c87e383c ]

    The memcpy() in uvc_video_decode_meta() intentionally copies across the
    length and flags members and into the trailing buf flexible array.
    Split the copy so that the compiler can better reason about (the lack
    of) buffer overflows here. Avoid the run-time false positive warning:

    memcpy: detected field-spanning write (size 12) of single field "&meta->length" at drivers/media/usb/uvc/uvc_video.c:1355 (size 1)

    Additionally fix a typo in the documentation for struct uvc_meta_buf.

    Reported-by: ionut_n2001@yahoo.com
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=216810
    Signed-off-by: Kees Cook <keescook@chromium.org>
    Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/media/usb/uvc/uvc_video.c | 4 +++-
    include/uapi/linux/uvcvideo.h | 2 +-
    2 files changed, 4 insertions(+), 2 deletions(-)

    diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
    index af2c6cb9fa3c4..f477cfbbb905a 100644
    --- a/drivers/media/usb/uvc/uvc_video.c
    +++ b/drivers/media/usb/uvc/uvc_video.c
    @@ -1334,7 +1334,9 @@ static void uvc_video_decode_meta(struct uvc_streaming *stream,
    if (has_scr)
    memcpy(stream->clock.last_scr, scr, 6);

    - memcpy(&meta->length, mem, length);
    + meta->length = mem[0];
    + meta->flags = mem[1];
    + memcpy(meta->buf, &mem[2], length - 2);
    meta_buf->bytesused += length + sizeof(meta->ns) + sizeof(meta->sof);

    uvc_dbg(stream->dev, FRAME,
    diff --git a/include/uapi/linux/uvcvideo.h b/include/uapi/linux/uvcvideo.h
    index 8288137387c0d..a9d0a64007ba5 100644
    --- a/include/uapi/linux/uvcvideo.h
    +++ b/include/uapi/linux/uvcvideo.h
    @@ -86,7 +86,7 @@ struct uvc_xu_control_query {
    * struct. The first two fields are added by the driver, they can be used for
    * clock synchronisation. The rest is an exact copy of a UVC payload header.
    * Only complete objects with complete buffers are included. Therefore it's
    - * always sizeof(meta->ts) + sizeof(meta->sof) + meta->length bytes large.
    + * always sizeof(meta->ns) + sizeof(meta->sof) + meta->length bytes large.
    */
    struct uvc_meta_buf {
    __u64 ns;
    --
    2.39.2
    \
     
     \ /
      Last update: 2023-03-27 00:43    [W:2.730 / U:0.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site