From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Mauro Carvalho Chehab <mchehab@s-opensource.com>,
Sakari Ailus <sakari.ailus@linux.intel.com>,
Hans Verkuil <hans.verkuil@cisco.com>
Subject: [PATCH 4.9 01/66] media: v4l2-compat-ioctl32: dont oops on overlay
Date: Tue, 17 Apr 2018 17:58:34 +0200 [thread overview]
Message-ID: <20180417155645.927913811@linuxfoundation.org> (raw)
In-Reply-To: <20180417155645.868055442@linuxfoundation.org>
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
commit 85ea29f19eab56ec16ec6b92bc67305998706afa upstream.
At put_v4l2_window32(), it tries to access kp->clips. However,
kp points to an userspace pointer. So, it should be obtained
via get_user(), otherwise it can OOPS:
vivid-000: ================== END STATUS ==================
BUG: unable to handle kernel paging request at 00000000fffb18e0
IP: [<ffffffffc05468d9>] __put_v4l2_format32+0x169/0x220 [videodev]
PGD 3f5776067 PUD 3f576f067 PMD 3f5769067 PTE 800000042548f067
Oops: 0001 [#1] SMP
Modules linked in: vivid videobuf2_vmalloc videobuf2_memops v4l2_dv_timings videobuf2_core v4l2_common videodev media xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables bluetooth rfkill binfmt_misc snd_hda_codec_hdmi i915 snd_hda_intel snd_hda_controller snd_hda_codec intel_rapl x86_pkg_temp_thermal snd_hwdep intel_powerclamp snd_pcm coretemp snd_seq_midi kvm_intel kvm snd_seq_midi_event snd_rawmidi i2c_algo_bit drm_kms_helper snd_seq drm crct10dif_pclmul e1000e snd_seq_device crc32_pclmul snd_timer ghash_clmulni_intel snd mei_me mei ptp pps_core soundcore lpc_ich video crc32c_intel [last unloaded: media]
CPU: 2 PID: 28332 Comm: v4l2-compliance Not tainted 3.18.102+ #107
Hardware name: /NUC5i7RYB, BIOS RYBDWi35.86A.0364.2017.0511.0949 05/11/2017
task: ffff8804293f8000 ti: ffff8803f5640000 task.ti: ffff8803f5640000
RIP: 0010:[<ffffffffc05468d9>] [<ffffffffc05468d9>] __put_v4l2_format32+0x169/0x220 [videodev]
RSP: 0018:ffff8803f5643e28 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000000fffb1ab4
RDX: 00000000fffb1a68 RSI: 00000000fffb18d8 RDI: 00000000fffb1aa8
RBP: ffff8803f5643e48 R08: 0000000000000001 R09: ffff8803f54b0378
R10: 0000000000000000 R11: 0000000000000168 R12: 00000000fffb18c0
R13: 00000000fffb1a94 R14: 00000000fffb18c8 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff880456d00000(0063) knlGS:00000000f7100980
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000fffb18e0 CR3: 00000003f552b000 CR4: 00000000003407e0
Stack:
00000000fffb1a94 00000000c0cc5640 0000000000000056 ffff8804274f3600
ffff8803f5643ed0 ffffffffc0547e16 0000000000000003 ffff8803f5643eb0
ffffffff81301460 ffff88009db44b01 ffff880441942520 ffff8800c0d05640
Call Trace:
[<ffffffffc0547e16>] v4l2_compat_ioctl32+0x12d6/0x1b1d [videodev]
[<ffffffff81301460>] ? file_has_perm+0x70/0xc0
[<ffffffff81252a2c>] compat_SyS_ioctl+0xec/0x1200
[<ffffffff8173241a>] sysenter_dispatch+0x7/0x21
Code: 00 00 48 8b 80 48 c0 ff ff 48 83 e8 38 49 39 c6 0f 87 2b ff ff ff 49 8d 45 1c e8 a3 ce e3 c0 85 c0 0f 85 1a ff ff ff 41 8d 40 ff <4d> 8b 64 24 20 41 89 d5 48 8d 44 40 03 4d 8d 34 c4 eb 15 0f 1f
RIP [<ffffffffc05468d9>] __put_v4l2_format32+0x169/0x220 [videodev]
RSP <ffff8803f5643e28>
CR2: 00000000fffb18e0
Tested with vivid driver on Kernel v3.18.102.
Same bug happens upstream too:
BUG: KASAN: user-memory-access in __put_v4l2_format32+0x98/0x4d0 [videodev]
Read of size 8 at addr 00000000ffe48400 by task v4l2-compliance/8713
CPU: 0 PID: 8713 Comm: v4l2-compliance Not tainted 4.16.0-rc4+ #108
Hardware name: /NUC5i7RYB, BIOS RYBDWi35.86A.0364.2017.0511.0949 05/11/2017
Call Trace:
dump_stack+0x5c/0x7c
kasan_report+0x164/0x380
? __put_v4l2_format32+0x98/0x4d0 [videodev]
__put_v4l2_format32+0x98/0x4d0 [videodev]
v4l2_compat_ioctl32+0x1aec/0x27a0 [videodev]
? __fsnotify_inode_delete+0x20/0x20
? __put_v4l2_format32+0x4d0/0x4d0 [videodev]
compat_SyS_ioctl+0x646/0x14d0
? do_ioctl+0x30/0x30
do_fast_syscall_32+0x191/0x3f4
entry_SYSENTER_compat+0x6b/0x7a
==================================================================
Disabling lock debugging due to kernel taint
BUG: unable to handle kernel paging request at 00000000ffe48400
IP: __put_v4l2_format32+0x98/0x4d0 [videodev]
PGD 3a22fb067 P4D 3a22fb067 PUD 39b6f0067 PMD 39b6f1067 PTE 80000003256af067
Oops: 0001 [#1] SMP KASAN
Modules linked in: vivid videobuf2_vmalloc videobuf2_dma_contig videobuf2_memops v4l2_tpg v4l2_dv_timings videobuf2_v4l2 videobuf2_common v4l2_common videodev xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack libcrc32c tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables bluetooth rfkill ecdh_generic binfmt_misc snd_hda_codec_hdmi intel_rapl x86_pkg_temp_thermal intel_powerclamp i915 coretemp snd_hda_intel snd_hda_codec kvm_intel snd_hwdep snd_hda_core kvm snd_pcm irqbypass crct10dif_pclmul crc32_pclmul snd_seq_midi ghash_clmulni_intel snd_seq_midi_event i2c_algo_bit intel_cstate snd_rawmidi intel_uncore snd_seq drm_kms_helper e1000e snd_seq_device snd_timer intel_rapl_perf
drm ptp snd mei_me mei lpc_ich pps_core soundcore video crc32c_intel
CPU: 0 PID: 8713 Comm: v4l2-compliance Tainted: G B 4.16.0-rc4+ #108
Hardware name: /NUC5i7RYB, BIOS RYBDWi35.86A.0364.2017.0511.0949 05/11/2017
RIP: 0010:__put_v4l2_format32+0x98/0x4d0 [videodev]
RSP: 0018:ffff8803b9be7d30 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff8803ac983e80 RCX: ffffffff8cd929f2
RDX: 1ffffffff1d0a149 RSI: 0000000000000297 RDI: 0000000000000297
RBP: 00000000ffe485c0 R08: fffffbfff1cf5123 R09: ffffffff8e7a8948
R10: 0000000000000001 R11: fffffbfff1cf5122 R12: 00000000ffe483e0
R13: 00000000ffe485c4 R14: ffff8803ac985918 R15: 00000000ffe483e8
FS: 0000000000000000(0000) GS:ffff880407400000(0063) knlGS:00000000f7a46980
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000ffe48400 CR3: 00000003a83f2003 CR4: 00000000003606f0
Call Trace:
v4l2_compat_ioctl32+0x1aec/0x27a0 [videodev]
? __fsnotify_inode_delete+0x20/0x20
? __put_v4l2_format32+0x4d0/0x4d0 [videodev]
compat_SyS_ioctl+0x646/0x14d0
? do_ioctl+0x30/0x30
do_fast_syscall_32+0x191/0x3f4
entry_SYSENTER_compat+0x6b/0x7a
Code: 4c 89 f7 4d 8d 7c 24 08 e8 e6 a4 69 cb 48 8b 83 98 1a 00 00 48 83 e8 10 49 39 c7 0f 87 9d 01 00 00 49 8d 7c 24 20 e8 c8 a4 69 cb <4d> 8b 74 24 20 4c 89 ef 4c 89 fe ba 10 00 00 00 e8 23 d9 08 cc
RIP: __put_v4l2_format32+0x98/0x4d0 [videodev] RSP: ffff8803b9be7d30
CR2: 00000000ffe48400
cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
@@ -101,7 +101,7 @@ static int get_v4l2_window32(struct v4l2
static int put_v4l2_window32(struct v4l2_window __user *kp,
struct v4l2_window32 __user *up)
{
- struct v4l2_clip __user *kclips = kp->clips;
+ struct v4l2_clip __user *kclips;
struct v4l2_clip32 __user *uclips;
compat_caddr_t p;
u32 clipcount;
@@ -116,6 +116,8 @@ static int put_v4l2_window32(struct v4l2
if (!clipcount)
return 0;
+ if (get_user(kclips, &kp->clips))
+ return -EFAULT;
if (get_user(p, &up->clips))
return -EFAULT;
uclips = compat_ptr(p);
next prev parent reply other threads:[~2018-04-17 15:58 UTC|newest]
Thread overview: 82+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-04-17 15:58 [PATCH 4.9 00/66] 4.9.95-stable review Greg Kroah-Hartman
2018-04-17 15:58 ` Greg Kroah-Hartman [this message]
2018-04-17 15:58 ` [PATCH 4.9 02/66] parisc: Fix out of array access in match_pci_device() Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 03/66] Drivers: hv: vmbus: do not mark HV_PCIE as perf_device Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 04/66] perf intel-pt: Fix overlap detection to identify consecutive buffers correctly Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 05/66] perf intel-pt: Fix sync_switch Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 06/66] perf intel-pt: Fix error recovery from missing TIP packet Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 07/66] perf intel-pt: Fix timestamp following overflow Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 08/66] perf/core: Fix use-after-free in uprobe_perf_close() Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 09/66] radeon: hide pointless #warning when compile testing Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 10/66] arm64: barrier: Add CSDB macros to control data-value prediction Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 11/66] arm64: Implement array_index_mask_nospec() Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 12/66] arm64: move TASK_* definitions to <asm/processor.h> Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 13/66] arm64: Make USER_DS an inclusive limit Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 14/66] arm64: Use pointer masking to limit uaccess speculation Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 15/66] arm64: entry: Ensure branch through syscall table is bounded under speculation Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 16/66] arm64: uaccess: Prevent speculative use of the current addr_limit Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 17/66] arm64: uaccess: Dont bother eliding access_ok checks in __{get, put}_user Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 18/66] arm64: uaccess: Mask __user pointers for __arch_{clear, copy_*}_user Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 19/66] arm64: cpufeature: __this_cpu_has_cap() shouldnt stop early Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 20/66] arm64: Run enable method for errata work arounds on late CPUs Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 21/66] arm64: cpufeature: Pass capability structure to ->enable callback Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 22/66] drivers/firmware: Expose psci_get_version through psci_ops structure Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 23/66] arm64: Factor out TTBR0_EL1 post-update workaround into a specific asm macro Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 24/66] arm64: Move post_ttbr_update_workaround to C code Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 25/66] arm64: Add skeleton to harden the branch predictor against aliasing attacks Greg Kroah-Hartman
2018-04-17 15:58 ` [PATCH 4.9 26/66] arm64: Move BP hardening to check_and_switch_context Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 27/66] mm: Introduce lm_alias Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 28/66] arm64: KVM: Use per-CPU vector when BP hardening is enabled Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 29/66] arm64: entry: Apply BP hardening for high-priority synchronous exceptions Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 30/66] arm64: entry: Apply BP hardening for suspicious interrupts from EL0 Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 31/66] arm64: cputype: Add missing MIDR values for Cortex-A72 and Cortex-A75 Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 32/66] arm64: cpu_errata: Allow an erratum to be match for all revisions of a core Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 33/66] arm64: Implement branch predictor hardening for affected Cortex-A CPUs Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 34/66] arm64: Branch predictor hardening for Cavium ThunderX2 Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 35/66] arm64: KVM: Increment PC after handling an SMC trap Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 36/66] arm/arm64: KVM: Consolidate the PSCI include files Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 37/66] arm/arm64: KVM: Add PSCI_VERSION helper Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 38/66] arm/arm64: KVM: Add smccc accessors to PSCI code Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 39/66] arm/arm64: KVM: Implement PSCI 1.0 support Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 40/66] arm/arm64: KVM: Advertise SMCCC v1.1 Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 41/66] arm64: KVM: Make PSCI_VERSION a fast path Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 42/66] arm/arm64: KVM: Turn kvm_psci_version into a static inline Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 43/66] arm64: KVM: Report SMCCC_ARCH_WORKAROUND_1 BP hardening support Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 44/66] arm64: KVM: Add SMCCC_ARCH_WORKAROUND_1 fast handling Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 45/66] firmware/psci: Expose PSCI conduit Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 46/66] firmware/psci: Expose SMCCC version through psci_ops Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 47/66] arm/arm64: smccc: Make function identifiers an unsigned quantity Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 48/66] arm/arm64: smccc: Implement SMCCC v1.1 inline primitive Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 49/66] arm64: Add ARM_SMCCC_ARCH_WORKAROUND_1 BP hardening support Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 50/66] arm64: Kill PSCI_GET_VERSION as a variant-2 workaround Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 51/66] sunrpc: remove incorrect HMAC request initialization Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 52/66] Revert "perf tests: Decompress kernel module before objdump" Greg Kroah-Hartman
2018-09-05 18:50 ` Florian Fainelli
2018-09-05 19:29 ` Greg Kroah-Hartman
2018-09-05 20:08 ` Florian Fainelli
2018-04-17 15:59 ` [PATCH 4.9 53/66] block/loop: fix deadlock after loop_set_status Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 54/66] nfit: fix region registration vs block-data-window ranges Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 55/66] s390/qdio: dont retry EQBS after CCQ 96 Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 56/66] s390/qdio: dont merge ERROR output buffers Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 57/66] s390/ipl: ensure loadparm valid flag is set Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 58/66] getname_kernel() needs to make sure that ->name != ->iname in long case Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 59/66] Bluetooth: Fix connection if directed advertising and privacy is used Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 60/66] rtl8187: Fix NULL pointer dereference in priv->conf_mutex Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 61/66] hwmon: (ina2xx) Fix access to uninitialized mutex Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 62/66] cdc_ether: flag the Cinterion AHS8 modem by gemalto as WWAN Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 63/66] rds: MP-RDS may use an invalid c_path Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 64/66] slip: Check if rstate is initialized before uncompressing Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 65/66] vhost: fix vhost_vq_access_ok() log check Greg Kroah-Hartman
2018-04-17 15:59 ` [PATCH 4.9 66/66] lan78xx: Correctly indicate invalid OTP Greg Kroah-Hartman
2018-04-17 21:04 ` [PATCH 4.9 00/66] 4.9.95-stable review Shuah Khan
2018-04-17 23:03 ` kernelci.org bot
2018-04-18 15:38 ` Guenter Roeck
2018-04-18 17:42 ` Dan Rue
2018-04-19 7:56 ` Greg Kroah-Hartman
2018-04-19 11:12 ` Naresh Kamboju
2018-04-19 12:09 ` Ben Hutchings
2018-04-19 12:30 ` Naresh Kamboju
2018-04-19 13:21 ` Dan Rue
2018-04-19 14:03 ` Greg Kroah-Hartman
2018-04-19 20:04 ` Dan Rue
2018-04-20 6:27 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180417155645.927913811@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=hans.verkuil@cisco.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mchehab@s-opensource.com \
--cc=sakari.ailus@linux.intel.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.