lkml.org 
[lkml]   [2019]   [Oct]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 035/211] media: hdpvr: Add device num check and handling
    Date
    From: Luke Nowakowski-Krijger <lnowakow@eng.ucsd.edu>

    [ Upstream commit d4a6a9537bc32811486282206ecfb7c53754b74d ]

    Add hdpvr device num check and error handling

    We need to increment the device count atomically before we checkout a
    device to make sure that we do not reach the max count, otherwise we get
    out-of-bounds errors as reported by syzbot.

    Reported-and-tested-by: syzbot+aac8d0d7205f112045d2@syzkaller.appspotmail.com

    Signed-off-by: Luke Nowakowski-Krijger <lnowakow@eng.ucsd.edu>
    Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/media/usb/hdpvr/hdpvr-core.c | 12 +++++++++++-
    1 file changed, 11 insertions(+), 1 deletion(-)

    diff --git a/drivers/media/usb/hdpvr/hdpvr-core.c b/drivers/media/usb/hdpvr/hdpvr-core.c
    index 29ac7fc5b039f..46adee95f89d5 100644
    --- a/drivers/media/usb/hdpvr/hdpvr-core.c
    +++ b/drivers/media/usb/hdpvr/hdpvr-core.c
    @@ -275,6 +275,7 @@ static int hdpvr_probe(struct usb_interface *interface,
    #endif
    size_t buffer_size;
    int i;
    + int dev_num;
    int retval = -ENOMEM;

    /* allocate memory for our device state and initialize it */
    @@ -372,8 +373,17 @@ static int hdpvr_probe(struct usb_interface *interface,
    }
    #endif

    + dev_num = atomic_inc_return(&dev_nr);
    + if (dev_num >= HDPVR_MAX) {
    + v4l2_err(&dev->v4l2_dev,
    + "max device number reached, device register failed\n");
    + atomic_dec(&dev_nr);
    + retval = -ENODEV;
    + goto reg_fail;
    + }
    +
    retval = hdpvr_register_videodev(dev, &interface->dev,
    - video_nr[atomic_inc_return(&dev_nr)]);
    + video_nr[dev_num]);
    if (retval < 0) {
    v4l2_err(&dev->v4l2_dev, "registering videodev failed\n");
    goto reg_fail;
    --
    2.20.1


    \
     
     \ /
      Last update: 2019-10-03 18:18    [W:4.215 / U:0.452 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site