[PATCH] media: v4l2-isp: reject zero-sized parameter blocks
David Carlier <[email protected]>
| Newsgroups | org.kernel.vger.linux-kernel,org.kernel.vger.linux-media,org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
v4l2_isp_params_validate_buffer() advances by block->size but never
bounds it from below. A block with size 0 passes both the
block->size > buffer_size test and the comparison against info->size
whenever the driver's type_info[] entry is an uninitialised hole, so
the walk makes no forward progress and loops forever.
Drivers call this from vb2 .buf_prepare, so VIDIOC_QBUF on the
parameters video device hangs the calling task with the queue mutex
held. rppx1 has such a hole today; fix the core so the walk terminates
for any driver.
Require every block to be at least as large as its header. Blocks
carrying only a header to disable a block are exactly that size and
still pass.
Fixes: 3cb6de6fafb8 ("media: v4l2-core: Introduce v4l2-isp.c")
Cc: [email protected]
Signed-off-by: David Carlier <[email protected]>
---
drivers/media/v4l2-core/v4l2-isp.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/media/v4l2-core/v4l2-isp.c b/drivers/media/v4l2-core/v4l2-isp.c
index 1eb46e080afa..760e16a5ba9d 100644
--- a/drivers/media/v4l2-core/v4l2-isp.c
+++ b/drivers/media/v4l2-core/v4l2-isp.c
@@ -84,6 +84,13 @@ int v4l2_isp_params_validate_buffer(struct device *dev, struct vb2_buffer *vb,
return -EINVAL;
}
+ if (block->size < sizeof(*block)) {
+ dev_dbg(dev,
+ "Invalid block size %u at offset %zu\n",
+ block->size, block_offset);
+ return -EINVAL;
+ }
+
if (block->size > buffer_size) {
dev_dbg(dev, "Premature end of parameters data\n");
return -EINVAL;
--
2.55.0