[PATCH] Fix VIDIOCGAP corruption in ivtv

[PATCH] Fix VIDIOCGAP corruption in ivtv

[Alan Cox]

Frank Bennett reported that ivtv was causing skype to crash. With help
from one of their developers he showed it was a kernel problem.
VIDIOCGCAP copies a name into a fixed length buffer - ivtv uses names
that are too long and does not truncate them so corrupts a few bytes of
the app data area.

Possibly the names also want trimming but for now this should fix the
corruption case.

Signed-off-by: Alan Cox <alan@redhat.com>

--- linux.vanilla-2.6.25-rc8-mm2/drivers/media/video/ivtv/ivtv-ioctl.c	2008-04-13 15:36:53.000000000 +0100
+++ linux-2.6.25-rc8-mm2/drivers/media/video/ivtv/ivtv-ioctl.c	2008-04-20 12:15:33.000000000 +0100
@@ -742,7 +742,8 @@
 
 		memset(vcap, 0, sizeof(*vcap));
 		strcpy(vcap->driver, IVTV_DRIVER_NAME);     /* driver name */
-		strcpy(vcap->card, itv->card_name); 	    /* card type */
+		strncpy(vcap->card, itv->card_name,
+				sizeof(vcap->card)-1); 	    /* card type */
 		strcpy(vcap->bus_info, pci_name(itv->dev)); /* bus info... */
 		vcap->version = IVTV_DRIVER_VERSION; 	    /* version */
 		vcap->capabilities = itv->v4l2_cap; 	    /* capabilities */

--
		"Hello, welcome to Jon Masters' house of pain"
				- Jon after a particularly good night

Re: [PATCH] Fix VIDIOCGAP corruption in ivtv

[Hans Verkuil]

On Sunday 20 April 2008 13:27:36 Alan Cox wrote:
> Frank Bennett reported that ivtv was causing skype to crash. With
> help from one of their developers he showed it was a kernel problem.
> VIDIOCGCAP copies a name into a fixed length buffer - ivtv uses names
> that are too long and does not truncate them so corrupts a few bytes
> of the app data area.
>
> Possibly the names also want trimming but for now this should fix the
> corruption case.

Ouch, nasty one.

Mauro, can you apply this patch to the v4l-dvb master?

Mike, this one should obviously go into a 2.6.25 dot-release, and I 
think also to a 2.6.24 dot-release.

Frank, thank you for reporting this!

	Hans

Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>

>
> Signed-off-by: Alan Cox <alan@redhat.com>
>
> ---
> linux.vanilla-2.6.25-rc8-mm2/drivers/media/video/ivtv/ivtv-ioctl.c	20
>08-04-13 15:36:53.000000000 +0100 +++
> linux-2.6.25-rc8-mm2/drivers/media/video/ivtv/ivtv-ioctl.c	2008-04-20
> 12:15:33.000000000 +0100 @@ -742,7 +742,8 @@
>
>  		memset(vcap, 0, sizeof(*vcap));
>  		strcpy(vcap->driver, IVTV_DRIVER_NAME);     /* driver name */
> -		strcpy(vcap->card, itv->card_name); 	    /* card type */
> +		strncpy(vcap->card, itv->card_name,
> +				sizeof(vcap->card)-1); 	    /* card type */
>  		strcpy(vcap->bus_info, pci_name(itv->dev)); /* bus info... */
>  		vcap->version = IVTV_DRIVER_VERSION; 	    /* version */
>  		vcap->capabilities = itv->v4l2_cap; 	    /* capabilities */
>
> --
> 		"Hello, welcome to Jon Masters' house of pain"
> 				- Jon after a particularly good night
>
> --
> video4linux-list mailing list
> Unsubscribe
> mailto:video4linux-list-request@redhat.com?subject=unsubscribe
> https://www.redhat.com/mailman/listinfo/video4linux-list

Re: [PATCH] Fix VIDIOCGAP corruption in ivtv

[Michael Krufky]

Hans Verkuil wrote:
> On Sunday 20 April 2008 13:27:36 Alan Cox wrote:
>   
>> Frank Bennett reported that ivtv was causing skype to crash. With
>> help from one of their developers he showed it was a kernel problem.
>> VIDIOCGCAP copies a name into a fixed length buffer - ivtv uses names
>> that are too long and does not truncate them so corrupts a few bytes
>> of the app data area.
>>
>> Possibly the names also want trimming but for now this should fix the
>> corruption case.
>>     
>
> Ouch, nasty one.
>
> Mauro, can you apply this patch to the v4l-dvb master?
>
> Mike, this one should obviously go into a 2.6.25 dot-release, and I 
> think also to a 2.6.24 dot-release.
>
> Frank, thank you for reporting this!
>
> 	Hans
>
> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
>   

Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>


Mauro,

I'll get this into -stable for 2.6.24.y and 2.6.25.y as soon as it's in Linus' tree.  Please send this with your first round of patches for 2.6.26

Regards,

Mike







>   
>> Signed-off-by: Alan Cox <alan@redhat.com>
>>
>> ---
>> linux.vanilla-2.6.25-rc8-mm2/drivers/media/video/ivtv/ivtv-ioctl.c	20
>> 08-04-13 15:36:53.000000000 +0100 +++
>> linux-2.6.25-rc8-mm2/drivers/media/video/ivtv/ivtv-ioctl.c	2008-04-20
>> 12:15:33.000000000 +0100 @@ -742,7 +742,8 @@
>>
>>  		memset(vcap, 0, sizeof(*vcap));
>>  		strcpy(vcap->driver, IVTV_DRIVER_NAME);     /* driver name */
>> -		strcpy(vcap->card, itv->card_name); 	    /* card type */
>> +		strncpy(vcap->card, itv->card_name,
>> +				sizeof(vcap->card)-1); 	    /* card type */
>>  		strcpy(vcap->bus_info, pci_name(itv->dev)); /* bus info... */
>>  		vcap->version = IVTV_DRIVER_VERSION; 	    /* version */
>>  		vcap->capabilities = itv->v4l2_cap; 	    /* capabilities */
>>
>> --
>> 		"Hello, welcome to Jon Masters' house of pain"
>> 				- Jon after a particularly good night
>>
>> --
>> video4linux-list mailing list
>> Unsubscribe
>> mailto:video4linux-list-request@redhat.com?subject=unsubscribe
>> https://www.redhat.com/mailman/listinfo/video4linux-list
>>     
>
>
>   

Re: [PATCH] Fix VIDIOCGAP corruption in ivtv

[Mauro Carvalho Chehab]

On Sun, 20 Apr 2008 12:10:00 -0400
Michael Krufky <mkrufky@linuxtv.org> wrote:

> Hans Verkuil wrote:
> > On Sunday 20 April 2008 13:27:36 Alan Cox wrote:
> >   
> >> Frank Bennett reported that ivtv was causing skype to crash. With
> >> help from one of their developers he showed it was a kernel problem.
> >> VIDIOCGCAP copies a name into a fixed length buffer - ivtv uses names
> >> that are too long and does not truncate them so corrupts a few bytes
> >> of the app data area.
> >>
> >> Possibly the names also want trimming but for now this should fix the
> >> corruption case.
> >>     
> >
> > Ouch, nasty one.
> >
> > Mauro, can you apply this patch to the v4l-dvb master?
> >
> > Mike, this one should obviously go into a 2.6.25 dot-release, and I 
> > think also to a 2.6.24 dot-release.
> >
> > Frank, thank you for reporting this!
> >
> > 	Hans
> >
> > Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
> >   
> 
> Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>

In this case, it should be reviewed-by.

I should be sending this soon to Linus.

Cheers,
Mauro

Re: [PATCH] Fix VIDIOCGAP corruption in ivtv

[mkrufky]

Mauro Carvalho Chehab wrote:
> On Sun, 20 Apr 2008 12:10:00 -0400
> Michael Krufky <mkrufky@linuxtv.org> wrote:
>
>   
>> Hans Verkuil wrote:
>>     
>>> On Sunday 20 April 2008 13:27:36 Alan Cox wrote:
>>>   
>>>       
>>>> Frank Bennett reported that ivtv was causing skype to crash. With
>>>> help from one of their developers he showed it was a kernel problem.
>>>> VIDIOCGCAP copies a name into a fixed length buffer - ivtv uses names
>>>> that are too long and does not truncate them so corrupts a few bytes
>>>> of the app data area.
>>>>
>>>> Possibly the names also want trimming but for now this should fix the
>>>> corruption case.
>>>>     
>>>>         
>>> Ouch, nasty one.
>>>
>>> Mauro, can you apply this patch to the v4l-dvb master?
>>>
>>> Mike, this one should obviously go into a 2.6.25 dot-release, and I 
>>> think also to a 2.6.24 dot-release.
>>>
>>> Frank, thank you for reporting this!
>>>
>>> 	Hans
>>>
>>> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
>>>   
>>>       
>> Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
>>     
>
> In this case, it should be reviewed-by.
>
> I should be sending this soon to Linus.


Mauro,

I think it's wrong that you alter signatures.  You did this:

Reviewed-by: <mkrufky@linuxtv.org <mailto:mkrufky@linuxtv.org>>

But I provided this:

Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>

I sign the patch, because I have handled it in my -stable queue.


You put my email address without my name!

A signature is sacred and nobody should fudge it.

Please fix it before you send to -git.

-Mike

Re: [PATCH] Fix VIDIOCGAP corruption in ivtv

[Frank Bennett]

Maruo,

I don't want to make your life more complicated than necessary, but
while we're on the topic of attribution ...

The real work in identifying this issue was done by Andrew Macks, the
engineer at Skype. My role in the affair consisted of complaining,
sending along a log file, recompiling the kernel, and writing an email
message.

I relayed the initial response I received from Hans Verkuil to Andrew
(via skype chat, I do not have an email address for him), to let him
know that the problem was being addressed in the kernel, and he was
glad to hear the news. But watching things unfold, I have been feeling
slightly incomfortable that only my name might end up in the chain of
correspondence, and not his.  I would just like to slip in a note here
to that effect.

Frank Bennett



On Thu, Apr 24, 2008 at 2:34 AM, Mauro Carvalho Chehab
<mchehab@infradead.org> wrote:
> On Sun, 20 Apr 2008 12:10:00 -0400
>  Michael Krufky <mkrufky@linuxtv.org> wrote:
>
>  > Hans Verkuil wrote:
>  > > On Sunday 20 April 2008 13:27:36 Alan Cox wrote:
>  > >
>  > >> Frank Bennett reported that ivtv was causing skype to crash. With
>  > >> help from one of their developers he showed it was a kernel problem.
>  > >> VIDIOCGCAP copies a name into a fixed length buffer - ivtv uses names
>  > >> that are too long and does not truncate them so corrupts a few bytes
>  > >> of the app data area.
>  > >>
>  > >> Possibly the names also want trimming but for now this should fix the
>  > >> corruption case.
>  > >>
>  > >
>  > > Ouch, nasty one.
>  > >
>  > > Mauro, can you apply this patch to the v4l-dvb master?
>  > >
>  > > Mike, this one should obviously go into a 2.6.25 dot-release, and I
>  > > think also to a 2.6.24 dot-release.
>  > >
>  > > Frank, thank you for reporting this!
>  > >
>  > >     Hans
>  > >
>  > > Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
>  > >
>  >
>  > Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
>
>  In this case, it should be reviewed-by.
>
>  I should be sending this soon to Linus.
>
>  Cheers,
>  Mauro
>

Re: [PATCH] Fix VIDIOCGAP corruption in ivtv

[Mauro Carvalho Chehab]

>>> Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
>>
>> In this case, it should be reviewed-by.
>>
>> I should be sending this soon to Linus.
>
>
> Mauro,
>
> I think it's wrong that you alter signatures.  You did this:
>
> Reviewed-by: <mkrufky@linuxtv.org <mailto:mkrufky@linuxtv.org>>

Argh! I didn't notice that weird stuff. This should be fixed before 
forwarding the patch. Sorry for the mess.

> But I provided this:
>
> Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
>
> I sign the patch, because I have handled it in my -stable queue.

SOB is the proper tag for your -stable queue. However, asking me to add 
this to my tree is not what it is expected.

SOB is meant to track the patch history until it reaches the kernel. So, 
the first SOB(s) is(are) from its author(s). The author(s) will send this 
to a driver maintainer, that will send to a subsystem maintainer, etc, 
until reach mainstream.

In the case of this patch, it was sent to the ML. Hans picked it, as the 
maintainer of ivtv, and asked me to pull.

You didn't wrote the patch, not forwarded it to me, so, the tag doesn't 
apply on my tree.

After the merge at mainstream, you'll send this to stable. In this case, 
you'll take it from my tree, add your SOB, and forward it.

Unfortunately, it is a common mistake of people sending SOB's instead of 
acked-by or reviewed-by, so several maintainers warns about the improper 
usage of the tags and corrects it on their trees, or simply ignores such 
improper usage.

If you prefer, I may just drop the tag from my tree, or fix the 
"reviewed-by".

Cheers,
Mauro.

Re: [PATCH] Fix VIDIOCGAP corruption in ivtv

[Michael Krufky]

Mauro Carvalho Chehab wrote:
>>>> Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
>>>
>>> In this case, it should be reviewed-by.
>>>
>>> I should be sending this soon to Linus.
>>
>>
>> Mauro,
>>
>> I think it's wrong that you alter signatures.  You did this:
>>
>> Reviewed-by: <mkrufky@linuxtv.org <mailto:mkrufky@linuxtv.org>>
>
> Argh! I didn't notice that weird stuff. This should be fixed before
> forwarding the patch. Sorry for the mess.
>
> [snip]
>
> After the merge at mainstream, you'll send this to stable. In this
> case, you'll take it from my tree, add your SOB, and forward it.
>
> Unfortunately, it is a common mistake of people sending SOB's instead
> of acked-by or reviewed-by, so several maintainers warns about the
> improper usage of the tags and corrects it on their trees, or simply
> ignores such improper usage.

Good point.
>
> If you prefer, I may just drop the tag from my tree, or fix the
> "reviewed-by".

Perhaps it makes most sense to just drop my tag, in this case  -- that's
fine with me.

Regards,

Mike

Re: [PATCH] Fix VIDIOCGAP corruption in ivtv

[Mauro Carvalho Chehab]

Hi Frank/Alan,

On Thu, 24 Apr 2008 04:26:46 +0900
"Frank Bennett" <biercenator@gmail.com> wrote:

> Maruo,
> 
> I don't want to make your life more complicated than necessary, but
> while we're on the topic of attribution ...
> 
> The real work in identifying this issue was done by Andrew Macks, the
> engineer at Skype. My role in the affair consisted of complaining,
> sending along a log file, recompiling the kernel, and writing an email
> message.
> 
> I relayed the initial response I received from Hans Verkuil to Andrew
> (via skype chat, I do not have an email address for him), to let him
> know that the problem was being addressed in the kernel, and he was
> glad to hear the news. But watching things unfold, I have been feeling
> slightly incomfortable that only my name might end up in the chain of
> correspondence, and not his.  I would just like to slip in a note here
> to that effect.

Maybe we can just add his name in parenthesis. Would this patch description be
ok for you, Andrew and Alan?

Fix VIDIOCGAP corruption in ivtv

From: Alan Cox <alan@redhat.com>

Frank Bennett reported that ivtv was causing skype to crash. With help
from one of their developers (Andrew Macks) he showed it was a kernel problem.
VIDIOCGCAP copies a name into a fixed length buffer - ivtv uses names
that are too long and does not truncate them so corrupts a few bytes of
the app data area.

Possibly the names also want trimming but for now this should fix the
corruption case.

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>

Cheers,
Mauro

Re: [PATCH] Fix VIDIOCGAP corruption in ivtv

[Alan Cox]

On Thu, Apr 24, 2008 at 12:47:08PM -0300, Mauro Carvalho Chehab wrote:
> Maybe we can just add his name in parenthesis. Would this patch description be
> ok for you, Andrew and Alan?

I have no idea if Mr Macks did the work or minds his name being used so I 
can form no view on the change. Obviously please remove my sign off if you
make the change

Re: [PATCH] Fix VIDIOCGAP corruption in ivtv

[Mauro Carvalho Chehab]

On Thu, 24 Apr 2008 12:00:43 -0400
Alan Cox <alan@redhat.com> wrote:

> On Thu, Apr 24, 2008 at 12:47:08PM -0300, Mauro Carvalho Chehab wrote:
> > Maybe we can just add his name in parenthesis. Would this patch description be
> > ok for you, Andrew and Alan?
> 
> I have no idea if Mr Macks did the work or minds his name being used so I 
> can form no view on the change. Obviously please remove my sign off if you
> make the change

So, I'll keep the patch as-is.

Cheers,
Mauro