linux-kernel - Re: [PATCH v5 12/13] media: v4l2-ioctl: Set error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 17 Mar 2021 12:39:48 +0100
From:   Hans Verkuil <hverkuil-cisco@...all.nl>
To:     Ricardo Ribalda <ribalda@...omium.org>,
        Laurent Pinchart <laurent.pinchart@...asonboard.com>,
        Mauro Carvalho Chehab <mchehab@...nel.org>,
        Sergey Senozhatsky <sergey.senozhatsky@...il.com>,
        linux-media@...r.kernel.org, linux-kernel@...r.kernel.org,
        tfiga@...omium.org
Subject: Re: [PATCH v5 12/13] media: v4l2-ioctl: Set error_idx to the right
 value

On 16/03/2021 19:00, Ricardo Ribalda wrote:
> If an error is found when validating the list of controls passed with
> VIDIOC_G_EXT_CTRLS, then error_idx shall be set to ctrls->count to
> indicate to userspace that no actual hardware was touched.
> 
> It would have been much nicer of course if error_idx could point to the
> control index that failed the validation, but sadly that's not how the
> API was designed.
> 
> Fixes v4l2-compliance:
> Control ioctls (Input 0):
> 	warn: v4l2-test-controls.cpp(834): error_idx should be equal to count
> 	warn: v4l2-test-controls.cpp(855): error_idx should be equal to count
> 	test VIDIOC_G/S/TRY_EXT_CTRLS: OK
> 
> Fixes: 6fa6f831f095 ("media: v4l2-ctrls: add core request support")
> Signed-off-by: Ricardo Ribalda <ribalda@...omium.org>
> ---
>  drivers/media/v4l2-core/v4l2-ioctl.c | 15 +++++++++++----
>  1 file changed, 11 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
> index 9406e90ff805..936ae21a0e0e 100644
> --- a/drivers/media/v4l2-core/v4l2-ioctl.c
> +++ b/drivers/media/v4l2-core/v4l2-ioctl.c
> @@ -2294,8 +2294,12 @@ static int v4l_g_ext_ctrls(const struct v4l2_ioctl_ops *ops,
>  					vfd, vfd->v4l2_dev->mdev, p);
>  	if (ops->vidioc_g_ext_ctrls == NULL)
>  		return -ENOTTY;
> -	return check_ext_ctrls(p, 0) ? ops->vidioc_g_ext_ctrls(file, fh, p) :
> -					-EINVAL;
> +
> +	if (check_ext_ctrls(p, 0))
> +		return ops->vidioc_g_ext_ctrls(file, fh, p);
> +
> +	p->error_idx = p->count;
> +	return -EINVAL;
>  }
>  
>  static int v4l_s_ext_ctrls(const struct v4l2_ioctl_ops *ops,
> @@ -2315,8 +2319,11 @@ static int v4l_s_ext_ctrls(const struct v4l2_ioctl_ops *ops,
>  					vfd, vfd->v4l2_dev->mdev, p);
>  	if (ops->vidioc_s_ext_ctrls == NULL)
>  		return -ENOTTY;
> -	return check_ext_ctrls(p, 0) ? ops->vidioc_s_ext_ctrls(file, fh, p) :
> -					-EINVAL;
> +	if (check_ext_ctrls(p, 0))
> +		return ops->vidioc_s_ext_ctrls(file, fh, p);
> +
> +	p->error_idx = p->count;
> +	return -EINVAL;
>  }
>  
>  static int v4l_try_ext_ctrls(const struct v4l2_ioctl_ops *ops,
> 

No, this patch is wrong. In all cases where check_ext_ctrls() is called the
code had already set error_idx to count. The real culprit is check_ext_ctrls()
that sets error_idx to the index of the failing control. But it can only do that
for the TRY ioctl.

In my review of patch 1 I mentioned that adding a bool is_get is a good idea.
I now this that it is best to pass the ioctl (G/S/TRY_EXT_CTRLS) instead and
based on that set error_idx here. In fact, if v4l_g/s_ctrl pass G/S_CTRL as the
ioctl argument to check_ext_ctrls(), then the allow_priv argument can be dropped
as well, since that can be decided based on the ioctl for which this function is
called.

Regards,

	Hans