| Message ID | 20230504135841.1566958-1-dzm91@hust.edu.cn |
|---|---|
| State | New |
| Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org>
Delivered-To: ouuuleilei@gmail.com
Received: by 2002:a59:b0ea:0:b0:3b6:4342:cba0 with SMTP id b10csp359125vqo;
Thu, 4 May 2023 07:24:55 -0700 (PDT)
X-Google-Smtp-Source:
ACHHUZ7i7MF11ZCbOd1Q3Ub3SWND6yWUMbJ0GINHpyBx1DkqtvNNj2W61/68j3NQJvKBmVR7VmvH
X-Received: by 2002:a17:902:da8f:b0:1ab:1b45:7974 with SMTP id
j15-20020a170902da8f00b001ab1b457974mr4532681plx.19.1683210294780;
Thu, 04 May 2023 07:24:54 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1683210294; cv=none;
d=google.com; s=arc-20160816;
b=A0yk+R+92H56YAIhN6ydiRsZpxy7mE0AZ3XpeVWiy3xXuyN33cuU4SAC7oVZ7vo7Yo
U8P+SkxUHxyKdp+2FyQl4f0ZcmduvUIKmiJMSf/NnNarPaoJIDUJajQDBe9h2a+aDBA0
Oy2z3qe3BU1BwKW56ZsPOu3NkqzisYC2vM9QFbMSD6FP4uGCqkeBEbtnhbrEJExbFJ7R
7ydVWoAeZnwMTuB6A5u3hzC/goM/Z/ae/1QpxA27H3mb2qRWvbnzCO+r9Q+BujWBfxgB
P/neSXSICwXz/QbrPBm44OStJ5CTYymXPk9oO1W+FfqC05whtfyukpMgfyod3nxb8JfP
3F3w==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com;
s=arc-20160816;
h=list-id:precedence:content-transfer-encoding:mime-version
:message-id:date:subject:cc:to:from;
bh=ErStqf0dz4wVPGGYMZkK+fnmvGcrBI1LWkPiClLakow=;
b=bPszOb+v2bHDUFljmtspxdRNNi2WtXF2mhZgvqLYYKT6/1N/g61J5fkz8vPV/pdZQi
ni1hoyd/jw5J9APJ8BaFEzT+EwE3GnQ9Z5XBDXRePFffnEzwIpjd3n0zSeieM4lgAK+t
39xmokZN7vnpuJa2JSd0Y/3pg0lWwoqh9tGGwsAWAyrVl03gAvA4BtKmzAxD6vv6EXH2
7GbNo8M6Eq4Y4NZiAyMS0qJHmYfOeP6pPzvc2aIYAFnqm+qQ2KI30imftoa149sshy6M
FdEc9wOqNDOus2EBz+KQwavnekOy9BaYczI8NKFhFE2vQRFYPvrum5HcUuLdw3FXM+GM
QgJQ==
ARC-Authentication-Results: i=1; mx.google.com;
spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org
designates 2620:137:e000::1:20 as permitted sender)
smtp.mailfrom=linux-kernel-owner@vger.kernel.org
Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20])
by mx.google.com with ESMTP id
p8-20020a170902e74800b001a966042af8si30687930plf.341.2023.05.04.07.24.41;
Thu, 04 May 2023 07:24:54 -0700 (PDT)
Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org
designates 2620:137:e000::1:20 as permitted sender)
client-ip=2620:137:e000::1:20;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org
designates 2620:137:e000::1:20 as permitted sender)
smtp.mailfrom=linux-kernel-owner@vger.kernel.org
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
id S231157AbjEDODF (ORCPT <rfc822;b08248@gmail.com> + 99 others);
Thu, 4 May 2023 10:03:05 -0400
Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48950 "EHLO
lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
with ESMTP id S229845AbjEDODD (ORCPT
<rfc822;linux-kernel@vger.kernel.org>);
Thu, 4 May 2023 10:03:03 -0400
Received: from hust.edu.cn (unknown [202.114.0.240])
by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AEDBE46BB
for <linux-kernel@vger.kernel.org>;
Thu, 4 May 2023 07:03:02 -0700 (PDT)
Received: from localhost.localdomain ([172.16.0.254])
(user=dzm91@hust.edu.cn mech=LOGIN bits=0)
by mx1.hust.edu.cn with ESMTP id 344E1fZO011334-344E1fZR011334
(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256
verify=NO);
Thu, 4 May 2023 22:01:46 +0800
From: Dongliang Mu <dzm91@hust.edu.cn>
To: Johan Hovold <johan@kernel.org>, Alex Elder <elder@kernel.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Jacopo Mondi <jacopo.mondi@linaro.org>,
Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: Dongliang Mu <dzm91@hust.edu.cn>,
Greg Kroah-Hartman <gregkh@google.com>,
greybus-dev@lists.linaro.org, linux-staging@lists.linux.dev,
linux-kernel@vger.kernel.org
Subject: [PATCH] drivers: staging: greybus: fix GPF issue in gb_camera_capture
Date: Thu, 4 May 2023 21:58:41 +0800
Message-Id: <20230504135841.1566958-1-dzm91@hust.edu.cn>
X-Mailer: git-send-email 2.39.2
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-FEAS-AUTH-USER: dzm91@hust.edu.cn
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,SPF_HELO_PASS,
SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no
version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?=
X-GMAIL-THRID: =?utf-8?q?1764973918016885327?=
X-GMAIL-MSGID: =?utf-8?q?1764973918016885327?=
|
| Series |
drivers: staging: greybus: fix GPF issue in gb_camera_capture
|
|
Commit Message
Dongliang Mu
May 4, 2023, 1:58 p.m. UTC
In gb_camera_capture(), it does not check the value of settings
before dereferencing it. And gb_camera_debugfs_capture calls
gb_camera_capture with the 6th parameter settings as NULL.
Fix this by checking the value of setting at the starting of
gb_camera_capture.
Fixes: 3265edaf0d70 ("greybus: Add driver for the camera class protocol")
Signed-off-by: Dongliang Mu <dzm91@hust.edu.cn>
---
drivers/staging/greybus/camera.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Comments
On 5/4/23 8:58 AM, Dongliang Mu wrote: > In gb_camera_capture(), it does not check the value of settings > before dereferencing it. And gb_camera_debugfs_capture calls > gb_camera_capture with the 6th parameter settings as NULL. > > Fix this by checking the value of setting at the starting of > gb_camera_capture. The req->settings pointer you're checking here is actually an address. It refers to the flexible array at the end of the gb_camera_capture_request structure. If the settings_size argument is zero, nothing will be copied; otherwise no more bytes will be copied than were allocated. So your proposed patch serves no purpose. If you really want to improve this bit of code, I'd suggest calling struct_size(req, settings, settings_size) rather than manually computing it in the assignment to req_size. And... if you do that, look for other places to do that in the Greybus code--and plan to fix them all. -Alex > > Fixes: 3265edaf0d70 ("greybus: Add driver for the camera class protocol") > Signed-off-by: Dongliang Mu <dzm91@hust.edu.cn> > --- > drivers/staging/greybus/camera.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/staging/greybus/camera.c b/drivers/staging/greybus/camera.c > index cdbb42cd413b..5a4b26e7f645 100644 > --- a/drivers/staging/greybus/camera.c > +++ b/drivers/staging/greybus/camera.c > @@ -659,7 +659,7 @@ static int gb_camera_capture(struct gb_camera *gcam, u32 request_id, > size_t req_size; > int ret; > > - if (settings_size > GB_CAMERA_MAX_SETTINGS_SIZE) > + if (settings_size > GB_CAMERA_MAX_SETTINGS_SIZE || !settings) > return -EINVAL; > > req_size = sizeof(*req) + settings_size;
On Thu, May 04, 2023 at 09:58:41PM +0800, Dongliang Mu wrote: > In gb_camera_capture(), it does not check the value of settings > before dereferencing it. And gb_camera_debugfs_capture calls > gb_camera_capture with the 6th parameter settings as NULL. > > Fix this by checking the value of setting at the starting of > gb_camera_capture. > > Fixes: 3265edaf0d70 ("greybus: Add driver for the camera class protocol") > Signed-off-by: Dongliang Mu <dzm91@hust.edu.cn> > --- No. The original code is correct. memcpy(p, NULL, 0); is allowed. I don't see a bug. regards, dan carpenter
On Thu, May 04, 2023 at 09:58:41PM +0800, Dongliang Mu wrote: > In gb_camera_capture(), it does not check the value of settings > before dereferencing it. And gb_camera_debugfs_capture calls > gb_camera_capture with the 6th parameter settings as NULL. Looks like you just broke gb_camera_debugfs_capture() which relies on passing NULL as settings. > Fix this by checking the value of setting at the starting of > gb_camera_capture. > > Fixes: 3265edaf0d70 ("greybus: Add driver for the camera class protocol") > Signed-off-by: Dongliang Mu <dzm91@hust.edu.cn> > --- > drivers/staging/greybus/camera.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/staging/greybus/camera.c b/drivers/staging/greybus/camera.c > index cdbb42cd413b..5a4b26e7f645 100644 > --- a/drivers/staging/greybus/camera.c > +++ b/drivers/staging/greybus/camera.c > @@ -659,7 +659,7 @@ static int gb_camera_capture(struct gb_camera *gcam, u32 request_id, > size_t req_size; > int ret; > > - if (settings_size > GB_CAMERA_MAX_SETTINGS_SIZE) > + if (settings_size > GB_CAMERA_MAX_SETTINGS_SIZE || !settings) > return -EINVAL; > > req_size = sizeof(*req) + settings_size; Johan
On 5/4/23 PM10:53, Dan Carpenter wrote: > On Thu, May 04, 2023 at 09:58:41PM +0800, Dongliang Mu wrote: >> In gb_camera_capture(), it does not check the value of settings >> before dereferencing it. And gb_camera_debugfs_capture calls >> gb_camera_capture with the 6th parameter settings as NULL. >> >> Fix this by checking the value of setting at the starting of >> gb_camera_capture. >> >> Fixes: 3265edaf0d70 ("greybus: Add driver for the camera class protocol") >> Signed-off-by: Dongliang Mu <dzm91@hust.edu.cn> >> --- > No. The original code is correct. memcpy(p, NULL, 0); is allowed. Oh, I see. This memcpy with src as NULL and len as zero is intended. Thanks, Dan. Sorry for the false alarm, guys. > I don't see a bug. > > regards, > dan carpenter
On 5/4/23 PM10:54, Johan Hovold wrote: > On Thu, May 04, 2023 at 09:58:41PM +0800, Dongliang Mu wrote: >> In gb_camera_capture(), it does not check the value of settings >> before dereferencing it. And gb_camera_debugfs_capture calls >> gb_camera_capture with the 6th parameter settings as NULL. > Looks like you just broke gb_camera_debugfs_capture() which relies on > passing NULL as settings. Yes, just mentioned by Dan, this memcpy is intended with zero length and NULL src. Please ignore this patch. >> Fix this by checking the value of setting at the starting of >> gb_camera_capture. >> >> Fixes: 3265edaf0d70 ("greybus: Add driver for the camera class protocol") >> Signed-off-by: Dongliang Mu <dzm91@hust.edu.cn> >> --- >> drivers/staging/greybus/camera.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/drivers/staging/greybus/camera.c b/drivers/staging/greybus/camera.c >> index cdbb42cd413b..5a4b26e7f645 100644 >> --- a/drivers/staging/greybus/camera.c >> +++ b/drivers/staging/greybus/camera.c >> @@ -659,7 +659,7 @@ static int gb_camera_capture(struct gb_camera *gcam, u32 request_id, >> size_t req_size; >> int ret; >> >> - if (settings_size > GB_CAMERA_MAX_SETTINGS_SIZE) >> + if (settings_size > GB_CAMERA_MAX_SETTINGS_SIZE || !settings) >> return -EINVAL; >> >> req_size = sizeof(*req) + settings_size; > Johan
diff --git a/drivers/staging/greybus/camera.c b/drivers/staging/greybus/camera.c index cdbb42cd413b..5a4b26e7f645 100644 --- a/drivers/staging/greybus/camera.c +++ b/drivers/staging/greybus/camera.c @@ -659,7 +659,7 @@ static int gb_camera_capture(struct gb_camera *gcam, u32 request_id, size_t req_size; int ret; - if (settings_size > GB_CAMERA_MAX_SETTINGS_SIZE) + if (settings_size > GB_CAMERA_MAX_SETTINGS_SIZE || !settings) return -EINVAL; req_size = sizeof(*req) + settings_size;