linux-kernel - Re: [PATCH v5 2/4] media: v4l2-subdev: WARN_ON invalid v4l2_subdev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c9f6b614-2f60-9f54-cfbd-ec218e582f33@xs4all.nl>
Date:   Tue, 14 May 2019 13:54:36 +0200
From:   Hans Verkuil <hverkuil-cisco@...all.nl>
To:     Janusz Krzysztofik <jmkrzyszt@...il.com>,
        Mauro Carvalho Chehab <mchehab@...nel.org>
Cc:     Sakari Ailus <sakari.ailus@...ux.intel.com>,
        linux-media@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v5 2/4] media: v4l2-subdev: WARN_ON invalid
 v4l2_subdev_call() arguments

On 5/12/19 10:15 PM, Janusz Krzysztofik wrote:
> Invalid arguments passed to v4l2_subdev_call generally mean bugs.  Be
> noisy if that happens.
> 
> Signed-off-by: Janusz Krzysztofik <jmkrzyszt@...il.com>
> ---
>  drivers/media/v4l2-core/v4l2-subdev.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/media/v4l2-core/v4l2-subdev.c b/drivers/media/v4l2-core/v4l2-subdev.c
> index 890916674d42..5f2264575cd7 100644
> --- a/drivers/media/v4l2-core/v4l2-subdev.c
> +++ b/drivers/media/v4l2-core/v4l2-subdev.c
> @@ -122,8 +122,8 @@ static int subdev_close(struct file *file)
>  
>  static int check_which(__u32 which)
>  {
> -	if (which != V4L2_SUBDEV_FORMAT_TRY &&
> -	    which != V4L2_SUBDEV_FORMAT_ACTIVE)
> +	if (WARN_ON(which != V4L2_SUBDEV_FORMAT_TRY &&
> +		    which != V4L2_SUBDEV_FORMAT_ACTIVE))
>  		return -EINVAL;

But this is now also called when the user calls an ioctl. And in that
case there should be no warning. It's perfectly legal for userspace to
specify a random value for which, and in that case it is just a regular
userspace bug. Same for the other checks below.

Regards,

	Hans

>  
>  	return 0;
> @@ -132,7 +132,7 @@ static int check_which(__u32 which)
>  static int check_pad(struct v4l2_subdev *sd, __u32 pad)
>  {
>  #if defined(CONFIG_MEDIA_CONTROLLER)
> -	if (sd->entity.num_pads && pad >= sd->entity.num_pads)
> +	if (WARN_ON(sd->entity.num_pads && pad >= sd->entity.num_pads))
>  		return -EINVAL;
>  #endif
>  	return 0;
> @@ -228,7 +228,7 @@ static int check_set_selection(struct v4l2_subdev *sd,
>  
>  static int check_edid(struct v4l2_subdev *sd, struct v4l2_subdev_edid *edid)
>  {
> -	if (edid->blocks && edid->edid == NULL)
> +	if (WARN_ON(edid->blocks && edid->edid == NULL))
>  		return -EINVAL;
>  
>  	return check_pad(sd, edid->pad);
>