| Message ID | 20200108100013.284108-1-arnd@arndb.de (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | media: v4l2-core: only zero-out ioctl-read buffers | expand |
On Wed, Jan 08, 2020 at 11:00:00AM +0100, Arnd Bergmann wrote: > The memset() got moved out of the check for _IOC_NONE, so passing a > made-up command number with a size but no direction would allow clearing > data on user-provided pointers. > > Move video_get_user() back into the _IOC_NONE check where it belongs. > > Reported-by: syzbot+54fd8cca4b7226c94b8e@syzkaller.appspotmail.com > Fixes: 6c625c01c7a6 ("media: v4l2-core: split out data copy from video_usercopy") > Signed-off-by: Arnd Bergmann <arnd@arndb.de> Thanks for the fix, Arnd! Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com> > --- > drivers/media/v4l2-core/v4l2-ioctl.c | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) > > diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c > index b0d670715c27..0f11fc6b5447 100644 > --- a/drivers/media/v4l2-core/v4l2-ioctl.c > +++ b/drivers/media/v4l2-core/v4l2-ioctl.c > @@ -3208,12 +3208,12 @@ video_usercopy(struct file *file, unsigned int orig_cmd, unsigned long arg, > parg = mbuf; > } > > + err = video_get_user((void __user *)arg, parg, orig_cmd, > + &always_copy); > + if (err) > + goto out; > } > > - err = video_get_user((void __user *)arg, parg, orig_cmd, &always_copy); > - if (err) > - goto out; > - > err = check_array_args(cmd, parg, &array_size, &user_ptr, &kernel_ptr); > if (err < 0) > goto out;
diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c index b0d670715c27..0f11fc6b5447 100644 --- a/drivers/media/v4l2-core/v4l2-ioctl.c +++ b/drivers/media/v4l2-core/v4l2-ioctl.c @@ -3208,12 +3208,12 @@ video_usercopy(struct file *file, unsigned int orig_cmd, unsigned long arg, parg = mbuf; } + err = video_get_user((void __user *)arg, parg, orig_cmd, + &always_copy); + if (err) + goto out; } - err = video_get_user((void __user *)arg, parg, orig_cmd, &always_copy); - if (err) - goto out; - err = check_array_args(cmd, parg, &array_size, &user_ptr, &kernel_ptr); if (err < 0) goto out;
The memset() got moved out of the check for _IOC_NONE, so passing a made-up command number with a size but no direction would allow clearing data on user-provided pointers. Move video_get_user() back into the _IOC_NONE check where it belongs. Reported-by: syzbot+54fd8cca4b7226c94b8e@syzkaller.appspotmail.com Fixes: 6c625c01c7a6 ("media: v4l2-core: split out data copy from video_usercopy") Signed-off-by: Arnd Bergmann <arnd@arndb.de> --- drivers/media/v4l2-core/v4l2-ioctl.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)