| Message ID | 20200108105929.7kxwf5rthxnhwbuh@kili.mountain (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | media: v4l2-core: Fix Oops in ioctl | expand |
Hi Dan, Marking this as Obsoleted in patchwork since Arnd posted an identical patch for this already. Regards, Hans On 1/8/20 11:59 AM, Dan Carpenter wrote: > Syzbot reported a crash in video_usercopy(). It turns out when we > broke video_get_user() into a separate function then we accidentally > moved it outside the if block so it tries to memset a user pointer. > > Reported-by: syzbot+9240c422be249a8422bd@syzkaller.appspotmail.com > Fixes: c8ef1a6076bf ("media: v4l2-core: split out data copy from video_usercopy") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > --- > Not actually tested. :( Sorry. > > drivers/media/v4l2-core/v4l2-ioctl.c | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) > > diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c > index b68ff06009cd..aaf83e254272 100644 > --- a/drivers/media/v4l2-core/v4l2-ioctl.c > +++ b/drivers/media/v4l2-core/v4l2-ioctl.c > @@ -3205,12 +3205,12 @@ video_usercopy(struct file *file, unsigned int orig_cmd, unsigned long arg, > parg = mbuf; > } > > + err = video_get_user((void __user *)arg, parg, orig_cmd, > + &always_copy); > + if (err) > + goto out; > } > > - err = video_get_user((void __user *)arg, parg, orig_cmd, &always_copy); > - if (err) > - goto out; > - > err = check_array_args(cmd, parg, &array_size, &user_ptr, &kernel_ptr); > if (err < 0) > goto out; >
diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c index b68ff06009cd..aaf83e254272 100644 --- a/drivers/media/v4l2-core/v4l2-ioctl.c +++ b/drivers/media/v4l2-core/v4l2-ioctl.c @@ -3205,12 +3205,12 @@ video_usercopy(struct file *file, unsigned int orig_cmd, unsigned long arg, parg = mbuf; } + err = video_get_user((void __user *)arg, parg, orig_cmd, + &always_copy); + if (err) + goto out; } - err = video_get_user((void __user *)arg, parg, orig_cmd, &always_copy); - if (err) - goto out; - err = check_array_args(cmd, parg, &array_size, &user_ptr, &kernel_ptr); if (err < 0) goto out;
Syzbot reported a crash in video_usercopy(). It turns out when we broke video_get_user() into a separate function then we accidentally moved it outside the if block so it tries to memset a user pointer. Reported-by: syzbot+9240c422be249a8422bd@syzkaller.appspotmail.com Fixes: c8ef1a6076bf ("media: v4l2-core: split out data copy from video_usercopy") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- Not actually tested. :( Sorry. drivers/media/v4l2-core/v4l2-ioctl.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)