linux-kernel - [PATCH] media: v4l: subdev: Prevent NULL routes access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20241122143717.173344-1-demonsingur@gmail.com>
Date: Fri, 22 Nov 2024 16:37:12 +0200
From: Cosmin Tanislav <demonsingur@...il.com>
To: 
Cc: Mauro Carvalho Chehab <mchehab@...nel.org>,
	Sakari Ailus <sakari.ailus@...ux.intel.com>,
	Laurent Pinchart <laurent.pinchart+renesas@...asonboard.com>,
	Hans Verkuil <hverkuil@...all.nl>,
	Tomi Valkeinen <tomi.valkeinen@...asonboard.com>,
	Paweł Anikiel <panikiel@...gle.com>,
	linux-media@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Cosmin Tanislav <demonsingur@...il.com>
Subject: [PATCH] media: v4l: subdev: Prevent NULL routes access

When using v4l2_subdev_set_routing to set a subdev's routing, and the
passed routing.num_routes is 0, kmemdup is not called to populate the
routes of the new routing (which is fine, since we wouldn't want to pass
a possible NULL value to kmemdup).

This results in subdev's routing.routes to be NULL.

routing.routes is further used in some places without being guarded by
the same num_routes non-zero condition.

Fix it.

Signed-off-by: Cosmin Tanislav <demonsingur@...il.com>
---
 drivers/media/v4l2-core/v4l2-subdev.c | 46 +++++++++++++--------------
 1 file changed, 23 insertions(+), 23 deletions(-)

diff --git a/drivers/media/v4l2-core/v4l2-subdev.c b/drivers/media/v4l2-core/v4l2-subdev.c
index cde1774c9098d..4f0eecd7fd66f 100644
--- a/drivers/media/v4l2-core/v4l2-subdev.c
+++ b/drivers/media/v4l2-core/v4l2-subdev.c
@@ -605,6 +605,23 @@ subdev_ioctl_get_state(struct v4l2_subdev *sd, struct v4l2_subdev_fh *subdev_fh,
 			     v4l2_subdev_get_unlocked_active_state(sd);
 }
 
+static void subdev_copy_krouting(struct v4l2_subdev_routing *routing,
+				 struct v4l2_subdev_krouting *krouting)
+{
+	memset(routing->reserved, 0, sizeof(routing->reserved));
+
+	if (!krouting->routes) {
+		routing->num_routes = 0;
+		return;
+	}
+
+	memcpy((struct v4l2_subdev_route *)(uintptr_t)routing->routes,
+	       krouting->routes,
+	       min(krouting->num_routes, routing->len_routes) *
+	       sizeof(*krouting->routes));
+	routing->num_routes = krouting->num_routes;
+}
+
 static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
 			    struct v4l2_subdev_state *state)
 {
@@ -976,7 +993,6 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
 
 	case VIDIOC_SUBDEV_G_ROUTING: {
 		struct v4l2_subdev_routing *routing = arg;
-		struct v4l2_subdev_krouting *krouting;
 
 		if (!v4l2_subdev_enable_streams_api)
 			return -ENOIOCTLCMD;
@@ -984,15 +1000,7 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
 		if (!(sd->flags & V4L2_SUBDEV_FL_STREAMS))
 			return -ENOIOCTLCMD;
 
-		memset(routing->reserved, 0, sizeof(routing->reserved));
-
-		krouting = &state->routing;
-
-		memcpy((struct v4l2_subdev_route *)(uintptr_t)routing->routes,
-		       krouting->routes,
-		       min(krouting->num_routes, routing->len_routes) *
-		       sizeof(*krouting->routes));
-		routing->num_routes = krouting->num_routes;
+		subdev_copy_krouting(routing, &state->routing);
 
 		return 0;
 	}
@@ -1016,8 +1024,6 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
 		if (routing->num_routes > routing->len_routes)
 			return -EINVAL;
 
-		memset(routing->reserved, 0, sizeof(routing->reserved));
-
 		for (i = 0; i < routing->num_routes; ++i) {
 			const struct v4l2_subdev_route *route = &routes[i];
 			const struct media_pad *pads = sd->entity.pads;
@@ -1046,12 +1052,7 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
 		 * the routing table.
 		 */
 		if (!v4l2_subdev_has_op(sd, pad, set_routing)) {
-			memcpy((struct v4l2_subdev_route *)(uintptr_t)routing->routes,
-			       state->routing.routes,
-			       min(state->routing.num_routes, routing->len_routes) *
-			       sizeof(*state->routing.routes));
-			routing->num_routes = state->routing.num_routes;
-
+			subdev_copy_krouting(routing, &state->routing);
 			return 0;
 		}
 
@@ -1064,11 +1065,7 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
 		if (rval < 0)
 			return rval;
 
-		memcpy((struct v4l2_subdev_route *)(uintptr_t)routing->routes,
-		       state->routing.routes,
-		       min(state->routing.num_routes, routing->len_routes) *
-		       sizeof(*state->routing.routes));
-		routing->num_routes = state->routing.num_routes;
+		subdev_copy_krouting(routing, &state->routing);
 
 		return 0;
 	}
@@ -1956,6 +1953,9 @@ struct v4l2_subdev_route *
 __v4l2_subdev_next_active_route(const struct v4l2_subdev_krouting *routing,
 				struct v4l2_subdev_route *route)
 {
+	if (!routing->routes)
+		return NULL;
+
 	if (route)
 		++route;
 	else
-- 
2.47.0