linux-kernel - [PATCH] staging: media: ipu3: buffer overflow fix in imgu_map

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20221223123025.5948-1-a.burakov@rosalinux.ru>
Date:   Fri, 23 Dec 2022 15:30:25 +0300
From:   Aleksandr Burakov <a.burakov@...alinux.ru>
To:     Sakari Ailus <sakari.ailus@...ux.intel.com>,
        Bingbu Cao <bingbu.cao@...el.com>,
        Tianshu Qiu <tian.shu.qiu@...el.com>
Cc:     Aleksandr Burakov <a.burakov@...alinux.ru>,
        linux-media@...r.kernel.org, linux-staging@...ts.linux.dev,
        linux-kernel@...r.kernel.org, lvc-project@...uxtesting.org
Subject: [PATCH] staging: media: ipu3: buffer overflow fix in imgu_map_node

If imgu_node_map[i].css_queue is not equal to css_queue
then "i" after the loop could be equal to IMGU_NODE_NUM
that is more than the border value (IMGU_NODE_NUM - 1).
So imgu_map_node() call may return IMGU_NODE_NUM that is more
than expected value.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 7fc7af649ca7 ("media: staging/intel-ipu3: Add imgu top level pci device driver")
Signed-off-by: Aleksandr Burakov <a.burakov@...alinux.ru>
---
 drivers/staging/media/ipu3/ipu3.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/media/ipu3/ipu3.c b/drivers/staging/media/ipu3/ipu3.c
index 0c453b37f8c4..cb09eb3cc227 100644
--- a/drivers/staging/media/ipu3/ipu3.c
+++ b/drivers/staging/media/ipu3/ipu3.c
@@ -60,8 +60,10 @@ unsigned int imgu_map_node(struct imgu_device *imgu, unsigned int css_queue)
 	for (i = 0; i < IMGU_NODE_NUM; i++)
 		if (imgu_node_map[i].css_queue == css_queue)
 			break;
-
-	return i;
+	if (i < IMGU_NODE_NUM)
+		return i;
+	else
+		return (IMGU_NODE_NUM - 1);
 }
 
 /**************** Dummy buffers ****************/
-- 
2.25.1