From: "Cen Zhang (Microsoft)" <blbllhy@gmail.com>
To: mchehab@kernel.org, hverkuil@kernel.org
Cc: kees@kernel.org, rongqianfeng@vivo.com, axboe@kernel.dk,
linux-media@vger.kernel.org, linux-kernel@vger.kernel.org,
AutonomousCodeSecurity@microsoft.com,
tgopinath@linux.microsoft.com, kys@microsoft.com,
blbllhy@gmail.com, stable@vger.kernel.org
Subject: [PATCH v2] media: dvb-core: add upper bound check in DMX_SET_BUFFER_SIZE ioctl
Date: Wed, 22 Jul 2026 20:13:06 -0400 [thread overview]
Message-ID: <20260723001306.84709-1-blbllhy@gmail.com> (raw)
dvb_dvr_set_buffer_size() and dvb_dmxdev_set_buffer_size() pass the
user-supplied size argument directly to vmalloc() without any upper
bound check. This allows excessive kernel memory allocation via the
DMX_SET_BUFFER_SIZE ioctl, which can lead to system-wide OOM conditions.
Kernel panic - not syncing: System is deadlocked on memory
Call Trace:
out_of_memory+0x12fd/0x1370
__alloc_frozen_pages_noprof+0x2620/0x2fa0
__vmalloc_node_range_noprof+0x7fa/0x1490
dvb_dvr_do_ioctl+0x11e/0x260 (drivers/media/dvb-core/dmxdev.c:296)
dvb_usercopy+0x15b/0x360
Fix by cap both functions at 64 MB and return -EINVAL for oversized
requests.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Fixes: a095be4b030c ("V4L/DVB (7659): dvb-core: Implement DMX_SET_BUFFER_SIZE for dvr")
Cc: stable@vger.kernel.org
Reported-by: AutonomousCodeSecurity@microsoft.com
Link: https://lore.kernel.org/all/20260722193719.81157-1-blbllhy@gmail.com/
Signed-off-by: Cen Zhang (Microsoft) <blbllhy@gmail.com>
---
V2:
- Add Cc: stable and Link: tag
drivers/media/dvb-core/dmxdev.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
index 3c8bc75e4d6c..b4dc87945be1 100644
--- a/drivers/media/dvb-core/dmxdev.c
+++ b/drivers/media/dvb-core/dmxdev.c
@@ -20,6 +20,9 @@
#include <media/dmxdev.h>
#include <media/dvb_vb2.h>
+/* 64 MB upper bound for DVB ring buffer allocations */
+#define DVB_BUFFER_SIZE_MAX (64 * 1024 * 1024)
+
static int debug;
module_param(debug, int, 0644);
@@ -292,6 +295,8 @@ static int dvb_dvr_set_buffer_size(struct dmxdev *dmxdev,
return 0;
if (!size)
return -EINVAL;
+ if (size > DVB_BUFFER_SIZE_MAX)
+ return -EINVAL;
newmem = vmalloc(size);
if (!newmem)
@@ -333,6 +338,8 @@ static int dvb_dmxdev_set_buffer_size(struct dmxdev_filter *dmxdevfilter,
return -EINVAL;
if (dmxdevfilter->state >= DMXDEV_STATE_GO)
return -EBUSY;
+ if (size > DVB_BUFFER_SIZE_MAX)
+ return -EINVAL;
newmem = vmalloc(size);
if (!newmem)
--
2.53.0
reply other threads:[~2026-07-23 0:15 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260723001306.84709-1-blbllhy@gmail.com \
--to=blbllhy@gmail.com \
--cc=AutonomousCodeSecurity@microsoft.com \
--cc=axboe@kernel.dk \
--cc=hverkuil@kernel.org \
--cc=kees@kernel.org \
--cc=kys@microsoft.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab@kernel.org \
--cc=rongqianfeng@vivo.com \
--cc=stable@vger.kernel.org \
--cc=tgopinath@linux.microsoft.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox