linux-kernel - Re: [PATCH v2 3/3] media: dvbdev: Initialize sbuf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20240325154412.0b768835@booty>
Date: Mon, 25 Mar 2024 15:44:12 +0100
From: Luca Ceresoli <luca.ceresoli@...tlin.com>
To: Ricardo Ribalda <ribalda@...omium.org>
Cc: Thierry Reding <thierry.reding@...il.com>, Jonathan Hunter
 <jonathanh@...dia.com>, Sowjanya Komatineni <skomatineni@...dia.com>, Mauro
 Carvalho Chehab <mchehab@...nel.org>, Greg Kroah-Hartman
 <gregkh@...uxfoundation.org>, Hans Verkuil <hverkuil@...all.nl>,
 linux-media@...r.kernel.org, linux-tegra@...r.kernel.org,
 linux-staging@...ts.linux.dev, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 3/3] media: dvbdev: Initialize sbuf

Hello Ricardo,

On Mon, 25 Mar 2024 14:19:55 +0000
Ricardo Ribalda <ribalda@...omium.org> wrote:

> Because the size passed to copy_from_user() cannot be known beforehand,
> it needs to be checked during runtime with check_object_size. That makes
> gcc believe that the content of sbuf can be used before init.
> 
> Fix:
> ./include/linux/thread_info.h:215:17: warning: ‘sbuf’ may be used uninitialized [-Wmaybe-uninitialized]
> 
> Signed-off-by: Ricardo Ribalda <ribalda@...omium.org>
> ---
>  drivers/media/dvb-core/dvbdev.c             | 2 +-
>  drivers/staging/media/tegra-video/tegra20.c | 2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c
> index 733d0bc4b4cc3..b43695bc51e75 100644
> --- a/drivers/media/dvb-core/dvbdev.c
> +++ b/drivers/media/dvb-core/dvbdev.c
> @@ -956,7 +956,7 @@ int dvb_usercopy(struct file *file,
>  		 int (*func)(struct file *file,
>  			     unsigned int cmd, void *arg))
>  {
> -	char    sbuf[128];
> +	char    sbuf[128] = {};
>  	void    *mbuf = NULL;
>  	void    *parg = NULL;
>  	int     err  = -EINVAL;
> diff --git a/drivers/staging/media/tegra-video/tegra20.c b/drivers/staging/media/tegra-video/tegra20.c
> index c39b52d0e4447..630e2ff987a37 100644
> --- a/drivers/staging/media/tegra-video/tegra20.c
> +++ b/drivers/staging/media/tegra-video/tegra20.c
> @@ -164,6 +164,7 @@ static void tegra20_vi_get_input_formats(struct tegra_vi_channel *chan,
>  	unsigned int input_mbus_code = chan->fmtinfo->code;
>  
>  	(*main_input_format) = VI_INPUT_INPUT_FORMAT_YUV422;
> +	(*yuv_input_format) = VI_INPUT_YUV_INPUT_FORMAT_UYVY;

I agree with Thierry this seems to be the best fix, making this
function similar to tegra20_vi_get_output_formats().

However in this v2 your change ended up in patch 3 while it should be
in patch 1. I'm glad to add my Reviewed-by tag on a new version with
this fixed.

Luca

-- 
Luca Ceresoli, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com