Messages in this thread | | | Date | Wed, 8 Jan 2020 12:10:04 +0200 | From | Sakari Ailus <> | Subject | Re: [PATCH] media: v4l2-core: only zero-out ioctl-read buffers |
| |
On Wed, Jan 08, 2020 at 11:00:00AM +0100, Arnd Bergmann wrote: > The memset() got moved out of the check for _IOC_NONE, so passing a > made-up command number with a size but no direction would allow clearing > data on user-provided pointers. > > Move video_get_user() back into the _IOC_NONE check where it belongs. > > Reported-by: syzbot+54fd8cca4b7226c94b8e@syzkaller.appspotmail.com > Fixes: 6c625c01c7a6 ("media: v4l2-core: split out data copy from video_usercopy") > Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Thanks for the fix, Arnd!
Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
> --- > drivers/media/v4l2-core/v4l2-ioctl.c | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) > > diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c > index b0d670715c27..0f11fc6b5447 100644 > --- a/drivers/media/v4l2-core/v4l2-ioctl.c > +++ b/drivers/media/v4l2-core/v4l2-ioctl.c > @@ -3208,12 +3208,12 @@ video_usercopy(struct file *file, unsigned int orig_cmd, unsigned long arg, > parg = mbuf; > } > > + err = video_get_user((void __user *)arg, parg, orig_cmd, > + &always_copy); > + if (err) > + goto out; > } > > - err = video_get_user((void __user *)arg, parg, orig_cmd, &always_copy); > - if (err) > - goto out; > - > err = check_array_args(cmd, parg, &array_size, &user_ptr, &kernel_ptr); > if (err < 0) > goto out;
-- Sakari Ailus sakari.ailus@linux.intel.com
| |