linux-kernel - Re: [PATCH 1/2] [media] vb2: Fix an off by one error in 'vb2_plane

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <9aab41eb-5543-58d2-211f-95fb00f5176c@wanadoo.fr>
Date:   Mon, 24 Apr 2017 22:00:24 +0200
From:   Christophe JAILLET <christophe.jaillet@...adoo.fr>
To:     Sakari Ailus <sakari.ailus@....fi>
Cc:     pawel@...iak.com, m.szyprowski@...sung.com,
        kyungmin.park@...sung.com, mchehab@...nel.org,
        linux-media@...r.kernel.org, linux-kernel@...r.kernel.org,
        kernel-janitors@...r.kernel.org
Subject: Re: [PATCH 1/2] [media] vb2: Fix an off by one error in
 'vb2_plane_vaddr'

Le 24/04/2017 à 16:16, Sakari Ailus a écrit :
> On Sun, Apr 23, 2017 at 11:32:57PM +0200, Christophe JAILLET wrote:
>> We should ensure that 'plane_no' is '< vb->num_planes' as done in
>> 'vb2_plane_cookie' just a few lines below.
>>
>> Signed-off-by: Christophe JAILLET <christophe.jaillet@...adoo.fr>
>> ---
>>   drivers/media/v4l2-core/videobuf2-core.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
>> index 94afbbf92807..c0175ea7e7ad 100644
>> --- a/drivers/media/v4l2-core/videobuf2-core.c
>> +++ b/drivers/media/v4l2-core/videobuf2-core.c
>> @@ -868,7 +868,7 @@ EXPORT_SYMBOL_GPL(vb2_core_create_bufs);
>>   
>>   void *vb2_plane_vaddr(struct vb2_buffer *vb, unsigned int plane_no)
>>   {
>> -	if (plane_no > vb->num_planes || !vb->planes[plane_no].mem_priv)
>> +	if (plane_no >= vb->num_planes || !vb->planes[plane_no].mem_priv)
>>   		return NULL;
>>   
>>   	return call_ptr_memop(vb, vaddr, vb->planes[plane_no].mem_priv);
> Oh my. How could this happen?
>
> This should go to stable as well.
Should I resubmit with "Cc: stable@...r.kernel.org" or will you add it 
yourself?

CJ

> Reviewed-by: Sakari Ailus <sakari.ailus@...ux.intel.com>