[linux] 03/03: Re-apply "[media] videobuf2-v4l2: Verify planes array in buffer dequeueing"

[debian-kernel at lists.debian.org]

This is an automated email from the git hooks/post-receive script.

benh pushed a commit to branch master
in repository linux.

commit 5ba72559a15dc4d9150ddce792aa2b93ca3f8fd5
Author: Ben Hutchings <ben at decadent.org.uk>
Date:   Mon May 16 20:02:37 2016 +0100

    Re-apply "[media] videobuf2-v4l2: Verify planes array in buffer dequeueing"
    
    This was reverted upstream in 4.6 due to a regression but we have a fix for
    the regression (probably).
---
 debian/changelog                                   |  4 ++
 ...buf2-v4l2-verify-planes-array-in-buffer-d.patch | 52 ++++++++++++++++++++++
 debian/patches/series                              |  1 +
 3 files changed, 57 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index 182eae8..6a8ce27 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -2,6 +2,10 @@ linux (4.6-1~exp1) UNRELEASED; urgency=medium
 
   * New upstream release: http://kernelnewbies.org/Linux_4.6
 
+  [ Ben Hutchings ]
+  * Re-apply "[media] videobuf2-v4l2: Verify planes array in buffer dequeueing",
+    reverted upstream in 4.6
+
  -- Ben Hutchings <ben at decadent.org.uk>  Mon, 16 May 2016 19:33:45 +0100
 
 linux (4.6~rc7-1~exp1) experimental; urgency=medium
diff --git a/debian/patches/bugfix/all/media-videobuf2-v4l2-verify-planes-array-in-buffer-d.patch b/debian/patches/bugfix/all/media-videobuf2-v4l2-verify-planes-array-in-buffer-d.patch
new file mode 100644
index 0000000..5391ca0
--- /dev/null
+++ b/debian/patches/bugfix/all/media-videobuf2-v4l2-verify-planes-array-in-buffer-d.patch
@@ -0,0 +1,52 @@
+From: Sakari Ailus <sakari.ailus at linux.intel.com>
+Date: Sun, 3 Apr 2016 16:31:03 -0300
+Subject: [media] videobuf2-v4l2: Verify planes array in buffer dequeueing
+Origin: https://git.kernel.org/linus/2c1f6951a8a82e6de0d82b1158b5e493fc6c54ab
+
+When a buffer is being dequeued using VIDIOC_DQBUF IOCTL, the exact buffer
+which will be dequeued is not known until the buffer has been removed from
+the queue. The number of planes is specific to a buffer, not to the queue.
+
+This does lead to the situation where multi-plane buffers may be requested
+and queued with n planes, but VIDIOC_DQBUF IOCTL may be passed an argument
+struct with fewer planes.
+
+__fill_v4l2_buffer() however uses the number of planes from the dequeued
+videobuf2 buffer, overwriting kernel memory (the m.planes array allocated
+in video_usercopy() in v4l2-ioctl.c)  if the user provided fewer
+planes than the dequeued buffer had. Oops!
+
+Fixes: b0e0e1f83de3 ("[media] media: videobuf2: Prepare to divide videobuf2")
+
+Signed-off-by: Sakari Ailus <sakari.ailus at linux.intel.com>
+Acked-by: Hans Verkuil <hans.verkuil at cisco.com>
+Cc: stable at vger.kernel.org # for v4.4 and later
+Signed-off-by: Mauro Carvalho Chehab <mchehab at osg.samsung.com>
+---
+ drivers/media/v4l2-core/videobuf2-v4l2.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/media/v4l2-core/videobuf2-v4l2.c b/drivers/media/v4l2-core/videobuf2-v4l2.c
+index 91f552124050..8da7470ca364 100644
+--- a/drivers/media/v4l2-core/videobuf2-v4l2.c
++++ b/drivers/media/v4l2-core/videobuf2-v4l2.c
+@@ -74,6 +74,11 @@ static int __verify_planes_array(struct vb2_buffer *vb, const struct v4l2_buffer
+ 	return 0;
+ }
+ 
++static int __verify_planes_array_core(struct vb2_buffer *vb, const void *pb)
++{
++	return __verify_planes_array(vb, pb);
++}
++
+ /**
+  * __verify_length() - Verify that the bytesused value for each plane fits in
+  * the plane length and that the data offset doesn't exceed the bytesused value.
+@@ -437,6 +442,7 @@ static int __fill_vb2_buffer(struct vb2_buffer *vb,
+ }
+ 
+ static const struct vb2_buf_ops v4l2_buf_ops = {
++	.verify_planes_array	= __verify_planes_array_core,
+ 	.fill_user_buffer	= __fill_v4l2_buffer,
+ 	.fill_vb2_buffer	= __fill_vb2_buffer,
+ 	.copy_timestamp		= __copy_timestamp,
diff --git a/debian/patches/series b/debian/patches/series
index ca6c1ef..f28f1ed 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -102,6 +102,7 @@ features/all/securelevel/enable-cold-boot-attack-mitigation.patch
 bugfix/all/ptrace-being-capable-wrt-a-process-requires-mapped-uids-gids.patch
 debian/i386-686-pae-pci-set-pci-nobios-by-default.patch
 bugfix/all/KVM-MTRR-remove-MSR-0x2f8.patch
+bugfix/all/media-videobuf2-v4l2-verify-planes-array-in-buffer-d.patch
 
 # Tools bug fixes
 bugfix/all/usbip-document-tcp-wrappers.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git