linux-kernel - Re: [PATCH] media: v4l: subdev: Prevent NULL routes access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <456ed6cb-dbcb-41da-b906-671f4e9255b9@gmail.com>
Date: Mon, 25 Nov 2024 20:28:49 +0200
From: Cosmin Tanislav <demonsingur@...il.com>
To: Laurent Pinchart <laurent.pinchart@...asonboard.com>
Cc: Mauro Carvalho Chehab <mchehab@...nel.org>,
 Sakari Ailus <sakari.ailus@...ux.intel.com>,
 Hans Verkuil <hverkuil@...all.nl>,
 Tomi Valkeinen <tomi.valkeinen@...asonboard.com>,
 Paweł Anikiel <panikiel@...gle.com>,
 linux-media@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] media: v4l: subdev: Prevent NULL routes access



On 11/24/24 8:49 AM, Laurent Pinchart wrote:
> On Fri, Nov 22, 2024 at 04:37:12PM +0200, Cosmin Tanislav wrote:
>> When using v4l2_subdev_set_routing to set a subdev's routing, and the
>> passed routing.num_routes is 0, kmemdup is not called to populate the
>> routes of the new routing (which is fine, since we wouldn't want to pass
>> a possible NULL value to kmemdup).
>>
>> This results in subdev's routing.routes to be NULL.
>>
>> routing.routes is further used in some places without being guarded by
>> the same num_routes non-zero condition.
> 
> What other places is that ? Have you experienced a crash anywhere ?
> 

The other places are exactly the ones being fixed in this patch. I can
probably reword it if it's unclear.

>>
>> Fix it.
>>
> 
> A Fixes: tag would be good to help backporting.
> 
>> Signed-off-by: Cosmin Tanislav <demonsingur@...il.com>
>> ---
>>   drivers/media/v4l2-core/v4l2-subdev.c | 46 +++++++++++++--------------
>>   1 file changed, 23 insertions(+), 23 deletions(-)
>>
>> diff --git a/drivers/media/v4l2-core/v4l2-subdev.c b/drivers/media/v4l2-core/v4l2-subdev.c
>> index cde1774c9098d..4f0eecd7fd66f 100644
>> --- a/drivers/media/v4l2-core/v4l2-subdev.c
>> +++ b/drivers/media/v4l2-core/v4l2-subdev.c
>> @@ -605,6 +605,23 @@ subdev_ioctl_get_state(struct v4l2_subdev *sd, struct v4l2_subdev_fh *subdev_fh,
>>   			     v4l2_subdev_get_unlocked_active_state(sd);
>>   }
>>   
>> +static void subdev_copy_krouting(struct v4l2_subdev_routing *routing,
>> +				 struct v4l2_subdev_krouting *krouting)
> 
> The second argument should be const.
> 

Will do for V2.

>> +{
>> +	memset(routing->reserved, 0, sizeof(routing->reserved));
>> +
>> +	if (!krouting->routes) {
>> +		routing->num_routes = 0;
>> +		return;
>> +	}
>> +
>> +	memcpy((struct v4l2_subdev_route *)(uintptr_t)routing->routes,
>> +	       krouting->routes,
>> +	       min(krouting->num_routes, routing->len_routes) *
>> +	       sizeof(*krouting->routes));
>> +	routing->num_routes = krouting->num_routes;
>> +}
>> +
>>   static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
>>   			    struct v4l2_subdev_state *state)
>>   {
>> @@ -976,7 +993,6 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
>>   
>>   	case VIDIOC_SUBDEV_G_ROUTING: {
>>   		struct v4l2_subdev_routing *routing = arg;
>> -		struct v4l2_subdev_krouting *krouting;
>>   
>>   		if (!v4l2_subdev_enable_streams_api)
>>   			return -ENOIOCTLCMD;
>> @@ -984,15 +1000,7 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
>>   		if (!(sd->flags & V4L2_SUBDEV_FL_STREAMS))
>>   			return -ENOIOCTLCMD;
>>   
>> -		memset(routing->reserved, 0, sizeof(routing->reserved));
>> -
>> -		krouting = &state->routing;
>> -
>> -		memcpy((struct v4l2_subdev_route *)(uintptr_t)routing->routes,
>> -		       krouting->routes,
>> -		       min(krouting->num_routes, routing->len_routes) *
>> -		       sizeof(*krouting->routes));
>> -		routing->num_routes = krouting->num_routes;
>> +		subdev_copy_krouting(routing, &state->routing);
>>   
>>   		return 0;
>>   	}
>> @@ -1016,8 +1024,6 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
>>   		if (routing->num_routes > routing->len_routes)
>>   			return -EINVAL;
>>   
>> -		memset(routing->reserved, 0, sizeof(routing->reserved));
>> -
>>   		for (i = 0; i < routing->num_routes; ++i) {
>>   			const struct v4l2_subdev_route *route = &routes[i];
>>   			const struct media_pad *pads = sd->entity.pads;
>> @@ -1046,12 +1052,7 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
>>   		 * the routing table.
>>   		 */
>>   		if (!v4l2_subdev_has_op(sd, pad, set_routing)) {
>> -			memcpy((struct v4l2_subdev_route *)(uintptr_t)routing->routes,
>> -			       state->routing.routes,
>> -			       min(state->routing.num_routes, routing->len_routes) *
>> -			       sizeof(*state->routing.routes));
>> -			routing->num_routes = state->routing.num_routes;
>> -
>> +			subdev_copy_krouting(routing, &state->routing);
>>   			return 0;
>>   		}
>>   
>> @@ -1064,11 +1065,7 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
>>   		if (rval < 0)
>>   			return rval;
>>   
>> -		memcpy((struct v4l2_subdev_route *)(uintptr_t)routing->routes,
>> -		       state->routing.routes,
>> -		       min(state->routing.num_routes, routing->len_routes) *
>> -		       sizeof(*state->routing.routes));
>> -		routing->num_routes = state->routing.num_routes;
>> +		subdev_copy_krouting(routing, &state->routing);
>>   
>>   		return 0;
>>   	}
>> @@ -1956,6 +1953,9 @@ struct v4l2_subdev_route *
>>   __v4l2_subdev_next_active_route(const struct v4l2_subdev_krouting *routing,
>>   				struct v4l2_subdev_route *route)
>>   {
>> +	if (!routing->routes)
>> +		return NULL;
>> +
>>   	if (route)
>>   		++route;
>>   	else
>