* [intel-lts:4.19/android_s 677/30000] drivers/media/v4l2-core/v4l2-compat-ioctl32.c:1098 put_v4l2_subdev_routing() warn: check for integer overflow 'num_routes'
@ 2024-09-16 4:40 kernel test robot
0 siblings, 0 replies; 4+ messages in thread
From: kernel test robot @ 2024-09-16 4:40 UTC (permalink / raw)
To: oe-kbuild; +Cc: lkp, Dan Carpenter
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: Meng Wei <wei.meng@intel.com>
CC: "Pan, Kris" <kris.pan@intel.com>
CC: Chang Ying <ying.chang@intel.com>
tree: https://github.com/intel/linux-intel-lts.git 4.19/android_s
head: 84d5fc421289417e51781e27e64fbb0fc44216ae
commit: dcdab0d72b69b6291d08483c0baf62cf92e2a1bc [677/30000] v4l: subdev: Add [GS]_ROUTING subdev ioctls and operations
:::::: branch date: 13 days ago
:::::: commit date: 5 years ago
config: x86_64-randconfig-161-20240914 (https://download.01.org/0day-ci/archive/20240916/202409161236.pnGXSCjw-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202409161236.pnGXSCjw-lkp@intel.com/
smatch warnings:
drivers/media/v4l2-core/v4l2-compat-ioctl32.c:1098 put_v4l2_subdev_routing() warn: check for integer overflow 'num_routes'
vim +/num_routes +1098 drivers/media/v4l2-core/v4l2-compat-ioctl32.c
dcdab0d72b69b6 Meng Wei 2018-10-26 1081
dcdab0d72b69b6 Meng Wei 2018-10-26 1082 static int put_v4l2_subdev_routing(struct v4l2_subdev_routing __user *kp,
dcdab0d72b69b6 Meng Wei 2018-10-26 1083 struct v4l2_subdev_routing32 __user *up)
dcdab0d72b69b6 Meng Wei 2018-10-26 1084 {
dcdab0d72b69b6 Meng Wei 2018-10-26 1085 struct v4l2_subdev_route __user *uroutes;
dcdab0d72b69b6 Meng Wei 2018-10-26 1086 compat_caddr_t p;
dcdab0d72b69b6 Meng Wei 2018-10-26 1087 u32 num_routes;
dcdab0d72b69b6 Meng Wei 2018-10-26 1088
dcdab0d72b69b6 Meng Wei 2018-10-26 1089 if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
dcdab0d72b69b6 Meng Wei 2018-10-26 1090 get_user(p, &up->routes) ||
dcdab0d72b69b6 Meng Wei 2018-10-26 1091 get_user(num_routes, &kp->num_routes) ||
dcdab0d72b69b6 Meng Wei 2018-10-26 1092 assign_in_user(&up->num_routes, &kp->num_routes) ||
dcdab0d72b69b6 Meng Wei 2018-10-26 1093 !access_ok(VERIFY_WRITE, up->reserved, sizeof(*up->reserved)))
dcdab0d72b69b6 Meng Wei 2018-10-26 1094 return -EFAULT;
dcdab0d72b69b6 Meng Wei 2018-10-26 1095
dcdab0d72b69b6 Meng Wei 2018-10-26 1096 uroutes = compat_ptr(p);
dcdab0d72b69b6 Meng Wei 2018-10-26 1097
dcdab0d72b69b6 Meng Wei 2018-10-26 @1098 if (!access_ok(VERIFY_WRITE, uroutes,
dcdab0d72b69b6 Meng Wei 2018-10-26 1099 num_routes * sizeof(*kp->routes)))
dcdab0d72b69b6 Meng Wei 2018-10-26 1100 return -EFAULT;
dcdab0d72b69b6 Meng Wei 2018-10-26 1101
dcdab0d72b69b6 Meng Wei 2018-10-26 1102 return 0;
dcdab0d72b69b6 Meng Wei 2018-10-26 1103 }
dcdab0d72b69b6 Meng Wei 2018-10-26 1104
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 4+ messages in thread
* [intel-lts:4.19/android_s 677/30000] drivers/media/v4l2-core/v4l2-compat-ioctl32.c:1098 put_v4l2_subdev_routing() warn: check for integer overflow 'num_routes'
@ 2024-09-16 7:41 Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2024-09-16 7:41 UTC (permalink / raw)
To: oe-kbuild, Meng Wei; +Cc: lkp, oe-kbuild-all, Pan, Kris, Chang Ying
tree: https://github.com/intel/linux-intel-lts.git 4.19/android_s
head: 84d5fc421289417e51781e27e64fbb0fc44216ae
commit: dcdab0d72b69b6291d08483c0baf62cf92e2a1bc [677/30000] v4l: subdev: Add [GS]_ROUTING subdev ioctls and operations
config: x86_64-randconfig-161-20240914 (https://download.01.org/0day-ci/archive/20240916/202409161236.pnGXSCjw-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
| Closes: https://lore.kernel.org/r/202409161236.pnGXSCjw-lkp@intel.com/
smatch warnings:
drivers/media/v4l2-core/v4l2-compat-ioctl32.c:1098 put_v4l2_subdev_routing() warn: check for integer overflow 'num_routes'
vim +/num_routes +1098 drivers/media/v4l2-core/v4l2-compat-ioctl32.c
dcdab0d72b69b6 Meng Wei 2018-10-26 1082 static int put_v4l2_subdev_routing(struct v4l2_subdev_routing __user *kp,
dcdab0d72b69b6 Meng Wei 2018-10-26 1083 struct v4l2_subdev_routing32 __user *up)
dcdab0d72b69b6 Meng Wei 2018-10-26 1084 {
dcdab0d72b69b6 Meng Wei 2018-10-26 1085 struct v4l2_subdev_route __user *uroutes;
dcdab0d72b69b6 Meng Wei 2018-10-26 1086 compat_caddr_t p;
dcdab0d72b69b6 Meng Wei 2018-10-26 1087 u32 num_routes;
dcdab0d72b69b6 Meng Wei 2018-10-26 1088
dcdab0d72b69b6 Meng Wei 2018-10-26 1089 if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
dcdab0d72b69b6 Meng Wei 2018-10-26 1090 get_user(p, &up->routes) ||
dcdab0d72b69b6 Meng Wei 2018-10-26 1091 get_user(num_routes, &kp->num_routes) ||
dcdab0d72b69b6 Meng Wei 2018-10-26 1092 assign_in_user(&up->num_routes, &kp->num_routes) ||
dcdab0d72b69b6 Meng Wei 2018-10-26 1093 !access_ok(VERIFY_WRITE, up->reserved, sizeof(*up->reserved)))
dcdab0d72b69b6 Meng Wei 2018-10-26 1094 return -EFAULT;
dcdab0d72b69b6 Meng Wei 2018-10-26 1095
dcdab0d72b69b6 Meng Wei 2018-10-26 1096 uroutes = compat_ptr(p);
dcdab0d72b69b6 Meng Wei 2018-10-26 1097
dcdab0d72b69b6 Meng Wei 2018-10-26 @1098 if (!access_ok(VERIFY_WRITE, uroutes,
dcdab0d72b69b6 Meng Wei 2018-10-26 1099 num_routes * sizeof(*kp->routes)))
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
This multiplication has an integer overflow bug on 32bit systems. Just do:
if (!access_ok(VERIFY_WRITE, uroutes,
size_mul(num_routes, sizeof(*kp->routes)))
dcdab0d72b69b6 Meng Wei 2018-10-26 1100 return -EFAULT;
dcdab0d72b69b6 Meng Wei 2018-10-26 1101
dcdab0d72b69b6 Meng Wei 2018-10-26 1102 return 0;
dcdab0d72b69b6 Meng Wei 2018-10-26 1103 }
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 4+ messages in thread
* [intel-lts:4.19/android_s 677/30000] drivers/media/v4l2-core/v4l2-compat-ioctl32.c:1098 put_v4l2_subdev_routing() warn: check for integer overflow 'num_routes'
@ 2024-09-20 4:07 kernel test robot
0 siblings, 0 replies; 4+ messages in thread
From: kernel test robot @ 2024-09-20 4:07 UTC (permalink / raw)
To: oe-kbuild; +Cc: lkp, Dan Carpenter
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: Meng Wei <wei.meng@intel.com>
CC: "Pan, Kris" <kris.pan@intel.com>
CC: Chang Ying <ying.chang@intel.com>
tree: https://github.com/intel/linux-intel-lts.git 4.19/android_s
head: 84d5fc421289417e51781e27e64fbb0fc44216ae
commit: dcdab0d72b69b6291d08483c0baf62cf92e2a1bc [677/30000] v4l: subdev: Add [GS]_ROUTING subdev ioctls and operations
:::::: branch date: 2 weeks ago
:::::: commit date: 5 years ago
config: x86_64-randconfig-161-20240914 (https://download.01.org/0day-ci/archive/20240920/202409201214.doUEuMvs-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202409201214.doUEuMvs-lkp@intel.com/
smatch warnings:
drivers/media/v4l2-core/v4l2-compat-ioctl32.c:1098 put_v4l2_subdev_routing() warn: check for integer overflow 'num_routes'
vim +/num_routes +1098 drivers/media/v4l2-core/v4l2-compat-ioctl32.c
dcdab0d72b69b6 Meng Wei 2018-10-26 1081
dcdab0d72b69b6 Meng Wei 2018-10-26 1082 static int put_v4l2_subdev_routing(struct v4l2_subdev_routing __user *kp,
dcdab0d72b69b6 Meng Wei 2018-10-26 1083 struct v4l2_subdev_routing32 __user *up)
dcdab0d72b69b6 Meng Wei 2018-10-26 1084 {
dcdab0d72b69b6 Meng Wei 2018-10-26 1085 struct v4l2_subdev_route __user *uroutes;
dcdab0d72b69b6 Meng Wei 2018-10-26 1086 compat_caddr_t p;
dcdab0d72b69b6 Meng Wei 2018-10-26 1087 u32 num_routes;
dcdab0d72b69b6 Meng Wei 2018-10-26 1088
dcdab0d72b69b6 Meng Wei 2018-10-26 1089 if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
dcdab0d72b69b6 Meng Wei 2018-10-26 1090 get_user(p, &up->routes) ||
dcdab0d72b69b6 Meng Wei 2018-10-26 1091 get_user(num_routes, &kp->num_routes) ||
dcdab0d72b69b6 Meng Wei 2018-10-26 1092 assign_in_user(&up->num_routes, &kp->num_routes) ||
dcdab0d72b69b6 Meng Wei 2018-10-26 1093 !access_ok(VERIFY_WRITE, up->reserved, sizeof(*up->reserved)))
dcdab0d72b69b6 Meng Wei 2018-10-26 1094 return -EFAULT;
dcdab0d72b69b6 Meng Wei 2018-10-26 1095
dcdab0d72b69b6 Meng Wei 2018-10-26 1096 uroutes = compat_ptr(p);
dcdab0d72b69b6 Meng Wei 2018-10-26 1097
dcdab0d72b69b6 Meng Wei 2018-10-26 @1098 if (!access_ok(VERIFY_WRITE, uroutes,
dcdab0d72b69b6 Meng Wei 2018-10-26 1099 num_routes * sizeof(*kp->routes)))
dcdab0d72b69b6 Meng Wei 2018-10-26 1100 return -EFAULT;
dcdab0d72b69b6 Meng Wei 2018-10-26 1101
dcdab0d72b69b6 Meng Wei 2018-10-26 1102 return 0;
dcdab0d72b69b6 Meng Wei 2018-10-26 1103 }
dcdab0d72b69b6 Meng Wei 2018-10-26 1104
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 4+ messages in thread
* [intel-lts:4.19/android_s 677/30000] drivers/media/v4l2-core/v4l2-compat-ioctl32.c:1098 put_v4l2_subdev_routing() warn: check for integer overflow 'num_routes'
@ 2024-09-25 8:04 Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2024-09-25 8:04 UTC (permalink / raw)
To: oe-kbuild, Meng Wei; +Cc: lkp, oe-kbuild-all, Pan, Kris, Chang Ying
tree: https://github.com/intel/linux-intel-lts.git 4.19/android_s
head: 84d5fc421289417e51781e27e64fbb0fc44216ae
commit: dcdab0d72b69b6291d08483c0baf62cf92e2a1bc [677/30000] v4l: subdev: Add [GS]_ROUTING subdev ioctls and operations
config: x86_64-randconfig-161-20240914 (https://download.01.org/0day-ci/archive/20240920/202409201214.doUEuMvs-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
| Closes: https://lore.kernel.org/r/202409201214.doUEuMvs-lkp@intel.com/
smatch warnings:
drivers/media/v4l2-core/v4l2-compat-ioctl32.c:1098 put_v4l2_subdev_routing() warn: check for integer overflow 'num_routes'
vim +/num_routes +1098 drivers/media/v4l2-core/v4l2-compat-ioctl32.c
dcdab0d72b69b6 Meng Wei 2018-10-26 1082 static int put_v4l2_subdev_routing(struct v4l2_subdev_routing __user *kp,
dcdab0d72b69b6 Meng Wei 2018-10-26 1083 struct v4l2_subdev_routing32 __user *up)
dcdab0d72b69b6 Meng Wei 2018-10-26 1084 {
dcdab0d72b69b6 Meng Wei 2018-10-26 1085 struct v4l2_subdev_route __user *uroutes;
dcdab0d72b69b6 Meng Wei 2018-10-26 1086 compat_caddr_t p;
dcdab0d72b69b6 Meng Wei 2018-10-26 1087 u32 num_routes;
dcdab0d72b69b6 Meng Wei 2018-10-26 1088
dcdab0d72b69b6 Meng Wei 2018-10-26 1089 if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
dcdab0d72b69b6 Meng Wei 2018-10-26 1090 get_user(p, &up->routes) ||
dcdab0d72b69b6 Meng Wei 2018-10-26 1091 get_user(num_routes, &kp->num_routes) ||
^^^^^^^^^^
num_routes comes from the user
dcdab0d72b69b6 Meng Wei 2018-10-26 1092 assign_in_user(&up->num_routes, &kp->num_routes) ||
dcdab0d72b69b6 Meng Wei 2018-10-26 1093 !access_ok(VERIFY_WRITE, up->reserved, sizeof(*up->reserved)))
dcdab0d72b69b6 Meng Wei 2018-10-26 1094 return -EFAULT;
dcdab0d72b69b6 Meng Wei 2018-10-26 1095
dcdab0d72b69b6 Meng Wei 2018-10-26 1096 uroutes = compat_ptr(p);
dcdab0d72b69b6 Meng Wei 2018-10-26 1097
dcdab0d72b69b6 Meng Wei 2018-10-26 @1098 if (!access_ok(VERIFY_WRITE, uroutes,
dcdab0d72b69b6 Meng Wei 2018-10-26 1099 num_routes * sizeof(*kp->routes)))
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
This can overflow on 32bit systems so it checks less than intended. Generally,
integer overflows in access_ok() are treated as bugs without further analysis to
see if it can actually be exploited.
dcdab0d72b69b6 Meng Wei 2018-10-26 1100 return -EFAULT;
dcdab0d72b69b6 Meng Wei 2018-10-26 1101
dcdab0d72b69b6 Meng Wei 2018-10-26 1102 return 0;
dcdab0d72b69b6 Meng Wei 2018-10-26 1103 }
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2024-09-25 8:04 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-09-20 4:07 [intel-lts:4.19/android_s 677/30000] drivers/media/v4l2-core/v4l2-compat-ioctl32.c:1098 put_v4l2_subdev_routing() warn: check for integer overflow 'num_routes' kernel test robot
-- strict thread matches above, loose matches on Subject: below --
2024-09-25 8:04 Dan Carpenter
2024-09-16 7:41 Dan Carpenter
2024-09-16 4:40 kernel test robot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.