From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D9775481CD; Tue, 26 Aug 2025 14:19:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756217986; cv=none; b=PZ3oSL135uqbR7MpI7Ex0+o0wQXN/ZMHNjFqWSvTjv+4InLSeVBt719WNDfAWZ0zGRsRaeMtZY4xjLtYNSSGbuWOIPYUrYCPR9/8QBg1V1Fez88oJsRtokGIcw/sdzWiPRr221H3jJazaa7Ar9Y2SIIAhrzYe8C0Wy1Qsu5XwW0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756217986; c=relaxed/simple; bh=Vf0fkoc47jahVgqrwiC/C8c8Y8uTyzizTV8OnGfqf6s=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Ms4VCEe+4LkoIxixv7LTNfwePRE+u6CKlnrmISYeZ+woMqPsR4ODTd2GIifZCsioUXKN50PtLoLqYD0Uhj0506k1NGNVmRlwBIQhECHN7eUR6quKmmRE4agln1tjFDN1/5ux6gnTCvVlG6ENjDMdLz1YrTPHKNbaeoXuO2IEBJE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=DORxi/g6; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="DORxi/g6" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 65A08C4CEF1; Tue, 26 Aug 2025 14:19:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1756217986; bh=Vf0fkoc47jahVgqrwiC/C8c8Y8uTyzizTV8OnGfqf6s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DORxi/g6n+M20QB2Lq4ax7CiAIFJdtD6c7ZOyibdqQmv9WIWDM0J/faLdtaAgqz8M LjZ5i5rjPseg+TEo29JnLO0LSG0hmjxGV57KS/5TAygqGuotUToeSMLZNcAVmKVe5t 0Cwf/zHokTpRZTlxmVoEZO/6RP5PEcVEdIdr6opI= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Laurent Pinchart , Hans de Goede , Ricardo Ribalda , Hans Verkuil Subject: [PATCH 5.10 351/523] media: uvcvideo: Do not mark valid metadata as invalid Date: Tue, 26 Aug 2025 13:09:21 +0200 Message-ID: <20250826110933.125154128@linuxfoundation.org> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250826110924.562212281@linuxfoundation.org> References: <20250826110924.562212281@linuxfoundation.org> User-Agent: quilt/0.68 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ricardo Ribalda commit bda2859bff0b9596a19648f3740c697ce4c71496 upstream. Currently, the driver performs a length check of the metadata buffer before the actual metadata size is known and before the metadata is decided to be copied. This results in valid metadata buffers being incorrectly marked as invalid. Move the length check to occur after the metadata size is determined and is decided to be copied. Cc: stable@vger.kernel.org Fixes: 088ead255245 ("media: uvcvideo: Add a metadata device node") Reviewed-by: Laurent Pinchart Reviewed-by: Hans de Goede Signed-off-by: Ricardo Ribalda Link: https://lore.kernel.org/r/20250707-uvc-meta-v8-1-ed17f8b1218b@chromium.org Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil Signed-off-by: Greg Kroah-Hartman --- drivers/media/usb/uvc/uvc_video.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) --- a/drivers/media/usb/uvc/uvc_video.c +++ b/drivers/media/usb/uvc/uvc_video.c @@ -1309,12 +1309,6 @@ static void uvc_video_decode_meta(struct if (!meta_buf || length == 2) return; - if (meta_buf->length - meta_buf->bytesused < - length + sizeof(meta->ns) + sizeof(meta->sof)) { - meta_buf->error = 1; - return; - } - has_pts = mem[1] & UVC_STREAM_PTS; has_scr = mem[1] & UVC_STREAM_SCR; @@ -1335,6 +1329,12 @@ static void uvc_video_decode_meta(struct !memcmp(scr, stream->clock.last_scr, 6))) return; + if (meta_buf->length - meta_buf->bytesused < + length + sizeof(meta->ns) + sizeof(meta->sof)) { + meta_buf->error = 1; + return; + } + meta = (struct uvc_meta_buf *)((u8 *)meta_buf->mem + meta_buf->bytesused); local_irq_save(flags); time = uvc_video_get_time();