From: Sean Young <sean@mess.org>
To: Jia-Ju Bai <baijiaju@tsinghua.edu.cn>
Cc: mchehab@kernel.org, pavel@ucw.cz, linux-media@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH] media: pci: ttpci: av7110: avoid compiler optimization of reading data[0] in debiirq()
Date: Sun, 30 Aug 2020 09:30:36 +0100 [thread overview]
Message-ID: <20200830083036.GA17715@gofer.mess.org> (raw)
In-Reply-To: <20200830082042.17462-1-baijiaju@tsinghua.edu.cn>
On Sun, Aug 30, 2020 at 04:20:42PM +0800, Jia-Ju Bai wrote:
> In debiirq(), data_0 stores the value of data[0], but it can be dropped
> by compiler optimization. Thus, data[0] is read through READ_ONCE().
>
> Fixes: 6499a0db9b0f ("media: pci: ttpci: av7110: fix possible buffer overflow caused by bad DMA value in debiirq()")
> Reported-by: Pavel Machek <pavel@ucw.cz>
Pavel reported that your patch was garbage, if you are trying to defend
against a malicious pci device. READ_ONCE() will not help here.
Sean
> Signed-off-by: Jia-Ju Bai <baijiaju@tsinghua.edu.cn>
> ---
> drivers/media/pci/ttpci/av7110.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/media/pci/ttpci/av7110.c b/drivers/media/pci/ttpci/av7110.c
> index bf36b1e22b63..f7d098d5b198 100644
> --- a/drivers/media/pci/ttpci/av7110.c
> +++ b/drivers/media/pci/ttpci/av7110.c
> @@ -406,7 +406,7 @@ static void debiirq(unsigned long cookie)
> case DATA_CI_GET:
> {
> u8 *data = av7110->debi_virt;
> - u8 data_0 = data[0];
> + u8 data_0 = READ_ONCE(data[0]);
>
> if (data_0 < 2 && data[2] == 0xff) {
> int flags = 0;
> --
> 2.17.1
next prev parent reply other threads:[~2020-08-30 8:30 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-30 8:20 [PATCH] media: pci: ttpci: av7110: avoid compiler optimization of reading data[0] in debiirq() Jia-Ju Bai
2020-08-30 8:30 ` Sean Young [this message]
2020-09-09 8:55 ` Pavel Machek
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200830083036.GA17715@gofer.mess.org \
--to=sean@mess.org \
--cc=baijiaju@tsinghua.edu.cn \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab@kernel.org \
--cc=pavel@ucw.cz \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.