linux-kernel - Re: [PATCH] media: Fix invalid link creation when source entity has 0 pads

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAKUZ0zKDy47cQ0ZQo-=1c7wmazbutF=VF3qX09DfZFBz01hh-g@mail.gmail.com>
Date: Sat, 29 Mar 2025 13:50:00 -0400
From: Gabriel <gshahrouzi@...il.com>
To: Laurent Pinchart <laurent.pinchart@...asonboard.com>
Cc: Ricardo Ribalda <ribalda@...omium.org>, hdegoede@...hat.com, mchehab@...nel.org, 
	linux-media@...r.kernel.org, linux-kernel@...r.kernel.org, 
	syzbot+701fc9cc0cb44e2b0fe9@...kaller.appspotmail.com, 
	skhan@...uxfoundation.org, kernelmentees@...ts.linuxfoundation.org
Subject: Re: [PATCH] media: Fix invalid link creation when source entity has 0 pads

Hi Laurent,

I’ve analyzed the bug report, and the root cause of the
"WARNING-media_create_pad_link" issue is a mismatch in terminal
references in the USB descriptor.

The format type descriptor references terminal ID 6, while the audio
streaming interface descriptor points to terminal ID 5. This
discrepancy triggers the warning: "No streaming interface found for
terminal 6", followed by the media pad link warning.

I confirmed this by changing the terminal ID in the format descriptor
from 6 to 5, which eliminates both warnings. This shows the warning is
correctly identifying an invalid descriptor configuration, not a
kernel bug.

Since the USB descriptor is invalid, I believe the warning is
necessary and should remain. The code should stay as is.

Regards,
Gabriel

On Tue, Mar 25, 2025 at 8:13 PM Laurent Pinchart
<laurent.pinchart@...asonboard.com> wrote:
>
> On Tue, Mar 25, 2025 at 06:05:00PM -0400, Gabriel wrote:
> > Hi Ricardo,
> >
> > > I cannot reach that URL
> > I was unable to access the URL from my email client when I initially
> > sent the email, but a couple of hours later, I was able to. Initially,
> > copying and pasting the URL into the browser provided a workaround.
> >
> > > Shouldn't it be?:
> > > Fixes: 4ffc2d89f38a ("[media] uvcvideo: Register subdevices for each entity")
> > You're right, I incorrectly referenced the wrong commit. However, I’m
> > not certain if it should reference a96aa5342d57 (Fixes: a96aa5342d57 -
> > '[media] uvcvideo: Ignore entities for terminals with no supported
> > format') as it's the latest commit affecting the line I'm changing or
> > the one you mentioned.
> >
> > > Shouldn't source->num_pads be the same as remote->num_pads?
> > The fuzzer (Syzkaller) that triggered the warning appears to have
> > encountered a case where source->num_pads and remote->num_pads were
> > different. When analyzing the case in GDB, remote->num_pads was 1,
> > while source->num_pads was 0.
>
> This seems like the real bug that should be fixed.
>
> > > Are you sure that your kernel does not contain?
> > > https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/drivers/media/usb/uvc/uvc_entity.c?id=41ddb251c68ac75c101d3a50a68c4629c9055e4c
> > Yes, it should be included since I am running the upstream kernel.
>
> --
> Regards,
>
> Laurent Pinchart