LinuxTV Patchwork [1/1] v4l: ioctl: Validate num_planes for debug messages

login
register
mail settings
Submitter Sakari Ailus
Date Jan. 10, 2019, 2:24 p.m.
Message ID <20190110142426.1124-1-sakari.ailus@linux.intel.com>
Download mbox | patch
Permalink /patch/53848/
State Accepted
Delegated to: Hans Verkuil
Headers show

Comments

Sakari Ailus - Jan. 10, 2019, 2:24 p.m.
The num_planes field in struct v4l2_pix_format_mplane is used in a loop
before validating it. As the use is printing a debug message in this case,
just cap the value to the maximum allowed.

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Cc: stable@vger.kernel.org
---
 drivers/media/v4l2-core/v4l2-ioctl.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
Thierry Reding - Jan. 10, 2019, 3:42 p.m.
On Thu, Jan 10, 2019 at 04:24:26PM +0200, Sakari Ailus wrote:
> The num_planes field in struct v4l2_pix_format_mplane is used in a loop
> before validating it. As the use is printing a debug message in this case,
> just cap the value to the maximum allowed.
> 
> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
> Cc: stable@vger.kernel.org
> ---
>  drivers/media/v4l2-core/v4l2-ioctl.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)

Seems reasonable:

Reviewed-by: Thierry Reding <treding@nvidia.com>
Hans Verkuil - Jan. 16, 2019, 1:59 p.m.
On 1/16/19 2:35 PM, Sasha Levin wrote:
> Hi,
> 
> [This is an automated email]
> 
> This commit has been processed because it contains a -stable tag.
> The stable tag indicates that it's relevant for the following trees: all
> 
> The bot has tested the following trees: v4.20.2, v4.19.15, v4.14.93, v4.9.150, v4.4.170, v3.18.132.
> 
> v4.20.2: Build OK!
> v4.19.15: Build OK!
> v4.14.93: Build OK!
> v4.9.150: Failed to apply! Possible dependencies:
>     fb9ffa6a7f7e ("[media] v4l: Add metadata buffer type and format")
> 
> v4.4.170: Failed to apply! Possible dependencies:
>     0579e6e3a326 ("doc-rst: linux_tv: remove whitespaces")
>     17defc282fe6 ("Documentation: add meta-documentation for Sphinx and kernel-doc")
>     22cba31bae9d ("Documentation/sphinx: add basic working Sphinx configuration and build")
>     234d549662a7 ("doc-rst: video: use reference for VIDIOC_ENUMINPUT")
>     5377d91f3e88 ("doc-rst: linux_tv DocBook to reST migration (docs-next)")
>     7347081e8a52 ("doc-rst: linux_tv: simplify references")
>     789818845202 ("doc-rst: audio: Fix some cross references")
>     94fff0dc5333 ("doc-rst: dmx_fcalls: improve man-like format")
>     9e00ffca8cc7 ("doc-rst: querycap: fix troubles on some references")
>     af4a4d0db8ab ("doc-rst: linux_tv: Replace reference names to match ioctls")
>     c2b66cafdf02 ("[media] v4l: doc: Remove row numbers from tables")
>     e6702ee18e24 ("doc-rst: app-pri: Fix a bad reference")
>     fb9ffa6a7f7e ("[media] v4l: Add metadata buffer type and format")
> 
> v3.18.132: Failed to apply! Possible dependencies:
>     0579e6e3a326 ("doc-rst: linux_tv: remove whitespaces")
>     17defc282fe6 ("Documentation: add meta-documentation for Sphinx and kernel-doc")
>     22cba31bae9d ("Documentation/sphinx: add basic working Sphinx configuration and build")
>     5377d91f3e88 ("doc-rst: linux_tv DocBook to reST migration (docs-next)")
>     5699f871d2d5 ("scripts/kernel-doc: Adding cross-reference links to html documentation.")
>     7347081e8a52 ("doc-rst: linux_tv: simplify references")
>     af4a4d0db8ab ("doc-rst: linux_tv: Replace reference names to match ioctls")
>     b479bfd00e46 ("DocBook: Use a fixed encoding for output")
>     c2b66cafdf02 ("[media] v4l: doc: Remove row numbers from tables")
>     e6702ee18e24 ("doc-rst: app-pri: Fix a bad reference")
>     fb9ffa6a7f7e ("[media] v4l: Add metadata buffer type and format")
> 
> 
> How should we proceed with this patch?

The Cc to stable of this patch in the pending pull request has a 'for v4.12 and up':

https://git.linuxtv.org/hverkuil/media_tree.git/commit/?h=for-v5.0a&id=8015f0ce4a3c533acfbb3a71f0d6659fa4120778

So no need to patch pre-4.12 kernels.

Regards,

	Hans

Patch

diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
index 3e57fa073b885..0e15b14055e5f 100644
--- a/drivers/media/v4l2-core/v4l2-ioctl.c
+++ b/drivers/media/v4l2-core/v4l2-ioctl.c
@@ -287,6 +287,7 @@  static void v4l_print_format(const void *arg, bool write_only)
 	const struct v4l2_window *win;
 	const struct v4l2_sdr_format *sdr;
 	const struct v4l2_meta_format *meta;
+	u32 planes;
 	unsigned i;
 
 	pr_cont("type=%s", prt_names(p->type, v4l2_type_names));
@@ -317,7 +318,8 @@  static void v4l_print_format(const void *arg, bool write_only)
 			prt_names(mp->field, v4l2_field_names),
 			mp->colorspace, mp->num_planes, mp->flags,
 			mp->ycbcr_enc, mp->quantization, mp->xfer_func);
-		for (i = 0; i < mp->num_planes; i++)
+		planes = min_t(u32, mp->num_planes, VIDEO_MAX_PLANES);
+		for (i = 0; i < planes; i++)
 			printk(KERN_DEBUG "plane %u: bytesperline=%u sizeimage=%u\n", i,
 					mp->plane_fmt[i].bytesperline,
 					mp->plane_fmt[i].sizeimage);

Privacy Policy