* Re: [PATCH] drivers: staging: greybus: fix GPF issue in gb_camera_capture
2023-05-04 13:58 [PATCH] drivers: staging: greybus: fix GPF issue in gb_camera_capture Dongliang Mu
@ 2023-05-04 14:34 ` Alex Elder
2023-05-04 14:53 ` Dan Carpenter
2023-05-04 14:54 ` Johan Hovold
2 siblings, 0 replies; 6+ messages in thread
From: Alex Elder @ 2023-05-04 14:34 UTC (permalink / raw)
To: Dongliang Mu, Johan Hovold, Alex Elder, Greg Kroah-Hartman,
Jacopo Mondi, Laurent Pinchart
Cc: Greg Kroah-Hartman, greybus-dev, linux-staging, linux-kernel
On 5/4/23 8:58 AM, Dongliang Mu wrote:
> In gb_camera_capture(), it does not check the value of settings
> before dereferencing it. And gb_camera_debugfs_capture calls
> gb_camera_capture with the 6th parameter settings as NULL.
>
> Fix this by checking the value of setting at the starting of
> gb_camera_capture.
The req->settings pointer you're checking here is actually an
address. It refers to the flexible array at the end of the
gb_camera_capture_request structure. If the settings_size
argument is zero, nothing will be copied; otherwise no more
bytes will be copied than were allocated. So your proposed
patch serves no purpose.
If you really want to improve this bit of code, I'd suggest
calling struct_size(req, settings, settings_size) rather
than manually computing it in the assignment to req_size.
And... if you do that, look for other places to do that in
the Greybus code--and plan to fix them all.
-Alex
>
> Fixes: 3265edaf0d70 ("greybus: Add driver for the camera class protocol")
> Signed-off-by: Dongliang Mu <dzm91@hust.edu.cn>
> ---
> drivers/staging/greybus/camera.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/staging/greybus/camera.c b/drivers/staging/greybus/camera.c
> index cdbb42cd413b..5a4b26e7f645 100644
> --- a/drivers/staging/greybus/camera.c
> +++ b/drivers/staging/greybus/camera.c
> @@ -659,7 +659,7 @@ static int gb_camera_capture(struct gb_camera *gcam, u32 request_id,
> size_t req_size;
> int ret;
>
> - if (settings_size > GB_CAMERA_MAX_SETTINGS_SIZE)
> + if (settings_size > GB_CAMERA_MAX_SETTINGS_SIZE || !settings)
> return -EINVAL;
>
> req_size = sizeof(*req) + settings_size;
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] drivers: staging: greybus: fix GPF issue in gb_camera_capture
2023-05-04 13:58 [PATCH] drivers: staging: greybus: fix GPF issue in gb_camera_capture Dongliang Mu
2023-05-04 14:34 ` Alex Elder
@ 2023-05-04 14:53 ` Dan Carpenter
2023-05-04 15:08 ` Dongliang Mu
2023-05-04 14:54 ` Johan Hovold
2 siblings, 1 reply; 6+ messages in thread
From: Dan Carpenter @ 2023-05-04 14:53 UTC (permalink / raw)
To: Dongliang Mu
Cc: Johan Hovold, Alex Elder, Greg Kroah-Hartman, Jacopo Mondi,
Laurent Pinchart, Greg Kroah-Hartman, greybus-dev, linux-staging,
linux-kernel
On Thu, May 04, 2023 at 09:58:41PM +0800, Dongliang Mu wrote:
> In gb_camera_capture(), it does not check the value of settings
> before dereferencing it. And gb_camera_debugfs_capture calls
> gb_camera_capture with the 6th parameter settings as NULL.
>
> Fix this by checking the value of setting at the starting of
> gb_camera_capture.
>
> Fixes: 3265edaf0d70 ("greybus: Add driver for the camera class protocol")
> Signed-off-by: Dongliang Mu <dzm91@hust.edu.cn>
> ---
No. The original code is correct. memcpy(p, NULL, 0); is allowed.
I don't see a bug.
regards,
dan carpenter
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] drivers: staging: greybus: fix GPF issue in gb_camera_capture
2023-05-04 14:53 ` Dan Carpenter
@ 2023-05-04 15:08 ` Dongliang Mu
0 siblings, 0 replies; 6+ messages in thread
From: Dongliang Mu @ 2023-05-04 15:08 UTC (permalink / raw)
To: Dan Carpenter
Cc: Johan Hovold, Alex Elder, Greg Kroah-Hartman, Jacopo Mondi,
Laurent Pinchart, Greg Kroah-Hartman, greybus-dev, linux-staging,
linux-kernel
On 5/4/23 PM10:53, Dan Carpenter wrote:
> On Thu, May 04, 2023 at 09:58:41PM +0800, Dongliang Mu wrote:
>> In gb_camera_capture(), it does not check the value of settings
>> before dereferencing it. And gb_camera_debugfs_capture calls
>> gb_camera_capture with the 6th parameter settings as NULL.
>>
>> Fix this by checking the value of setting at the starting of
>> gb_camera_capture.
>>
>> Fixes: 3265edaf0d70 ("greybus: Add driver for the camera class protocol")
>> Signed-off-by: Dongliang Mu <dzm91@hust.edu.cn>
>> ---
> No. The original code is correct. memcpy(p, NULL, 0); is allowed.
Oh, I see. This memcpy with src as NULL and len as zero is intended.
Thanks, Dan.
Sorry for the false alarm, guys.
> I don't see a bug.
>
> regards,
> dan carpenter
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] drivers: staging: greybus: fix GPF issue in gb_camera_capture
2023-05-04 13:58 [PATCH] drivers: staging: greybus: fix GPF issue in gb_camera_capture Dongliang Mu
2023-05-04 14:34 ` Alex Elder
2023-05-04 14:53 ` Dan Carpenter
@ 2023-05-04 14:54 ` Johan Hovold
2023-05-04 15:09 ` Dongliang Mu
2 siblings, 1 reply; 6+ messages in thread
From: Johan Hovold @ 2023-05-04 14:54 UTC (permalink / raw)
To: Dongliang Mu
Cc: Alex Elder, Greg Kroah-Hartman, Jacopo Mondi, Laurent Pinchart,
Greg Kroah-Hartman, greybus-dev, linux-staging, linux-kernel
On Thu, May 04, 2023 at 09:58:41PM +0800, Dongliang Mu wrote:
> In gb_camera_capture(), it does not check the value of settings
> before dereferencing it. And gb_camera_debugfs_capture calls
> gb_camera_capture with the 6th parameter settings as NULL.
Looks like you just broke gb_camera_debugfs_capture() which relies on
passing NULL as settings.
> Fix this by checking the value of setting at the starting of
> gb_camera_capture.
>
> Fixes: 3265edaf0d70 ("greybus: Add driver for the camera class protocol")
> Signed-off-by: Dongliang Mu <dzm91@hust.edu.cn>
> ---
> drivers/staging/greybus/camera.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/staging/greybus/camera.c b/drivers/staging/greybus/camera.c
> index cdbb42cd413b..5a4b26e7f645 100644
> --- a/drivers/staging/greybus/camera.c
> +++ b/drivers/staging/greybus/camera.c
> @@ -659,7 +659,7 @@ static int gb_camera_capture(struct gb_camera *gcam, u32 request_id,
> size_t req_size;
> int ret;
>
> - if (settings_size > GB_CAMERA_MAX_SETTINGS_SIZE)
> + if (settings_size > GB_CAMERA_MAX_SETTINGS_SIZE || !settings)
> return -EINVAL;
>
> req_size = sizeof(*req) + settings_size;
Johan
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] drivers: staging: greybus: fix GPF issue in gb_camera_capture
2023-05-04 14:54 ` Johan Hovold
@ 2023-05-04 15:09 ` Dongliang Mu
0 siblings, 0 replies; 6+ messages in thread
From: Dongliang Mu @ 2023-05-04 15:09 UTC (permalink / raw)
To: Johan Hovold
Cc: Alex Elder, Greg Kroah-Hartman, Jacopo Mondi, Laurent Pinchart,
Greg Kroah-Hartman, greybus-dev, linux-staging, linux-kernel
On 5/4/23 PM10:54, Johan Hovold wrote:
> On Thu, May 04, 2023 at 09:58:41PM +0800, Dongliang Mu wrote:
>> In gb_camera_capture(), it does not check the value of settings
>> before dereferencing it. And gb_camera_debugfs_capture calls
>> gb_camera_capture with the 6th parameter settings as NULL.
> Looks like you just broke gb_camera_debugfs_capture() which relies on
> passing NULL as settings.
Yes, just mentioned by Dan, this memcpy is intended with zero length and
NULL src.
Please ignore this patch.
>> Fix this by checking the value of setting at the starting of
>> gb_camera_capture.
>>
>> Fixes: 3265edaf0d70 ("greybus: Add driver for the camera class protocol")
>> Signed-off-by: Dongliang Mu <dzm91@hust.edu.cn>
>> ---
>> drivers/staging/greybus/camera.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/staging/greybus/camera.c b/drivers/staging/greybus/camera.c
>> index cdbb42cd413b..5a4b26e7f645 100644
>> --- a/drivers/staging/greybus/camera.c
>> +++ b/drivers/staging/greybus/camera.c
>> @@ -659,7 +659,7 @@ static int gb_camera_capture(struct gb_camera *gcam, u32 request_id,
>> size_t req_size;
>> int ret;
>>
>> - if (settings_size > GB_CAMERA_MAX_SETTINGS_SIZE)
>> + if (settings_size > GB_CAMERA_MAX_SETTINGS_SIZE || !settings)
>> return -EINVAL;
>>
>> req_size = sizeof(*req) + settings_size;
> Johan
^ permalink raw reply [flat|nested] 6+ messages in thread