linux-kernel - Re: [PATCH 1/3] media: uvcvideo: Fix allocation for small frame sizes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260122014509.GA183118@killaraus>
Date: Thu, 22 Jan 2026 03:45:09 +0200
From: Laurent Pinchart <laurent.pinchart@...asonboard.com>
To: Ricardo Ribalda <ribalda@...omium.org>
Cc: Hans de Goede <hansg@...nel.org>,
	Mauro Carvalho Chehab <mchehab@...nel.org>,
	Johannes Berg <johannes@...solutions.net>,
	Laurent Pinchart <laurent.pinchart@...net.be>,
	linux-media@...r.kernel.org, linux-kernel@...r.kernel.org,
	Itay Chamiel <itay.chamiel@...i>
Subject: Re: [PATCH 1/3] media: uvcvideo: Fix allocation for small frame sizes

Hi Ricardo,

Thank you for the patch.

On Wed, Jan 14, 2026 at 10:32:13AM +0000, Ricardo Ribalda wrote:
> If a frame has size of less or equal than one packet size
> uvc_alloc_urb_buffers() is unable to allocate memory for it due to a
> off-by-one error.
> 
> Fix the off-by-one-error and now that we are at it, make sure that
> stream->urb_size has always a valid value when we return from the
> function, even when an error happens.
> 
> Fixes: efdc8a9585ce ("V4L/DVB (10295): uvcvideo: Retry URB buffers allocation when the system is low on memory.")
> Reported-by: Itay Chamiel <itay.chamiel@...i>
> Closes: https://lore.kernel.org/linux-media/CANiDSCsSoZf2LsCCoWAUbCg6tJT-ypXR1B85aa6rAdMVYr2iBQ@mail.gmail.com/T/#t
> Co-developed-by: Itay Chamiel <itay.chamiel@...i>
> Signed-off-by: Itay Chamiel <itay.chamiel@...i>
> Signed-off-by: Ricardo Ribalda <ribalda@...omium.org>

Reviewed-by: Laurent Pinchart <laurent.pinchart@...asonboard.com>

> ---
>  drivers/media/usb/uvc/uvc_video.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
> index 2094e059d7d39ac5a196cbbd58f9bc997f1c1557..ec76595f3c4be0f49b798ec663d6855d78ab21c4 100644
> --- a/drivers/media/usb/uvc/uvc_video.c
> +++ b/drivers/media/usb/uvc/uvc_video.c
> @@ -1812,7 +1812,7 @@ static int uvc_alloc_urb_buffers(struct uvc_streaming *stream,
>  		npackets = UVC_MAX_PACKETS;
>  
>  	/* Retry allocations until one succeed. */
> -	for (; npackets > 1; npackets /= 2) {
> +	for (; npackets > 0; npackets /= 2) {
>  		stream->urb_size = psize * npackets;
>  
>  		for (i = 0; i < UVC_URBS; ++i) {
> @@ -1837,6 +1837,7 @@ static int uvc_alloc_urb_buffers(struct uvc_streaming *stream,
>  	uvc_dbg(stream->dev, VIDEO,
>  		"Failed to allocate URB buffers (%u bytes per packet)\n",
>  		psize);
> +	stream->urb_size = 0;
>  	return 0;
>  }
>  

-- 
Regards,

Laurent Pinchart