linux-cve-announce - CVE-2022-49247: media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <2025022626-CVE-2022-49247-66c2@gregkh>
Date: Wed, 26 Feb 2025 02:57:32 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2022-49247: media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED

If the callback 'start_streaming' fails, then all
queued buffers in the driver should be returned with
state 'VB2_BUF_STATE_QUEUED'. Currently, they are
returned with 'VB2_BUF_STATE_ERROR' which is wrong.
Fix this. This also fixes the warning:

[   65.583633] WARNING: CPU: 5 PID: 593 at drivers/media/common/videobuf2/videobuf2-core.c:1612 vb2_start_streaming+0xd4/0x160 [videobuf2_common]
[   65.585027] Modules linked in: snd_usb_audio snd_hwdep snd_usbmidi_lib snd_rawmidi snd_soc_hdmi_codec dw_hdmi_i2s_audio saa7115 stk1160 videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common videodev mc crct10dif_ce panfrost snd_soc_simple_card snd_soc_audio_graph_card snd_soc_spdif_tx snd_soc_simple_card_utils gpu_sched phy_rockchip_pcie snd_soc_rockchip_i2s rockchipdrm analogix_dp dw_mipi_dsi dw_hdmi cec drm_kms_helper drm rtc_rk808 rockchip_saradc industrialio_triggered_buffer kfifo_buf rockchip_thermal pcie_rockchip_host ip_tables x_tables ipv6
[   65.589383] CPU: 5 PID: 593 Comm: v4l2src0:src Tainted: G        W         5.16.0-rc4-62408-g32447129cb30-dirty #14
[   65.590293] Hardware name: Radxa ROCK Pi 4B (DT)
[   65.590696] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   65.591304] pc : vb2_start_streaming+0xd4/0x160 [videobuf2_common]
[   65.591850] lr : vb2_start_streaming+0x6c/0x160 [videobuf2_common]
[   65.592395] sp : ffff800012bc3ad0
[   65.592685] x29: ffff800012bc3ad0 x28: 0000000000000000 x27: ffff800012bc3cd8
[   65.593312] x26: 0000000000000000 x25: ffff00000d8a7800 x24: 0000000040045612
[   65.593938] x23: ffff800011323000 x22: ffff800012bc3cd8 x21: ffff00000908a8b0
[   65.594562] x20: ffff00000908a8c8 x19: 00000000fffffff4 x18: ffffffffffffffff
[   65.595188] x17: 000000040044ffff x16: 00400034b5503510 x15: ffff800011323f78
[   65.595813] x14: ffff000013163886 x13: ffff000013163885 x12: 00000000000002ce
[   65.596439] x11: 0000000000000028 x10: 0000000000000001 x9 : 0000000000000228
[   65.597064] x8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : fefefeff726c5e78
[   65.597690] x5 : ffff800012bc3990 x4 : 0000000000000000 x3 : ffff000009a34880
[   65.598315] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000007cd99f0
[   65.598940] Call trace:
[   65.599155]  vb2_start_streaming+0xd4/0x160 [videobuf2_common]
[   65.599672]  vb2_core_streamon+0x17c/0x1a8 [videobuf2_common]
[   65.600179]  vb2_streamon+0x54/0x88 [videobuf2_v4l2]
[   65.600619]  vb2_ioctl_streamon+0x54/0x60 [videobuf2_v4l2]
[   65.601103]  v4l_streamon+0x3c/0x50 [videodev]
[   65.601521]  __video_do_ioctl+0x1a4/0x428 [videodev]
[   65.601977]  video_usercopy+0x320/0x828 [videodev]
[   65.602419]  video_ioctl2+0x3c/0x58 [videodev]
[   65.602830]  v4l2_ioctl+0x60/0x90 [videodev]
[   65.603227]  __arm64_sys_ioctl+0xa8/0xe0
[   65.603576]  invoke_syscall+0x54/0x118
[   65.603911]  el0_svc_common.constprop.3+0x84/0x100
[   65.604332]  do_el0_svc+0x34/0xa0
[   65.604625]  el0_svc+0x1c/0x50
[   65.604897]  el0t_64_sync_handler+0x88/0xb0
[   65.605264]  el0t_64_sync+0x16c/0x170
[   65.605587] ---[ end trace 578e0ba07742170d ]---

The Linux kernel CVE team has assigned CVE-2022-49247 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.7 with commit 8ac456495a33d9466076fea94594181ceefb76d9 and fixed in 4.14.276 with commit 03054f22d5abd80ad89547512c2bfbfb2714d3ed
	Issue introduced in 3.7 with commit 8ac456495a33d9466076fea94594181ceefb76d9 and fixed in 4.19.238 with commit f04a520a422222fc921bf035dc67414c500a286a
	Issue introduced in 3.7 with commit 8ac456495a33d9466076fea94594181ceefb76d9 and fixed in 5.4.189 with commit 3cc050df73e3d973f1870a8dc0e177e77670bc7f
	Issue introduced in 3.7 with commit 8ac456495a33d9466076fea94594181ceefb76d9 and fixed in 5.10.110 with commit 4d68603cc4382174bc1e7d532e10675c48c6b257
	Issue introduced in 3.7 with commit 8ac456495a33d9466076fea94594181ceefb76d9 and fixed in 5.15.33 with commit a09e9882800fdfc5aab93f77c3f0132071d2191b
	Issue introduced in 3.7 with commit 8ac456495a33d9466076fea94594181ceefb76d9 and fixed in 5.16.19 with commit 2874122ca4ca74adec72d6d6bf8828228ec20f15
	Issue introduced in 3.7 with commit 8ac456495a33d9466076fea94594181ceefb76d9 and fixed in 5.17.2 with commit f66e6fd1488d26229f11d86616de1b658c70fa8a
	Issue introduced in 3.7 with commit 8ac456495a33d9466076fea94594181ceefb76d9 and fixed in 5.18 with commit fbe04b49a54e31f4321d632270207f0e6304cd16

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49247
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/media/usb/stk1160/stk1160-core.c
	drivers/media/usb/stk1160/stk1160-v4l.c
	drivers/media/usb/stk1160/stk1160.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/03054f22d5abd80ad89547512c2bfbfb2714d3ed
	https://git.kernel.org/stable/c/f04a520a422222fc921bf035dc67414c500a286a
	https://git.kernel.org/stable/c/3cc050df73e3d973f1870a8dc0e177e77670bc7f
	https://git.kernel.org/stable/c/4d68603cc4382174bc1e7d532e10675c48c6b257
	https://git.kernel.org/stable/c/a09e9882800fdfc5aab93f77c3f0132071d2191b
	https://git.kernel.org/stable/c/2874122ca4ca74adec72d6d6bf8828228ec20f15
	https://git.kernel.org/stable/c/f66e6fd1488d26229f11d86616de1b658c70fa8a
	https://git.kernel.org/stable/c/fbe04b49a54e31f4321d632270207f0e6304cd16