Re: [PATCH] drivers: staging: greybus: fix GPF issue in gb_camera_capture

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]


On 5/4/23 8:58 AM, Dongliang Mu wrote:
In gb_camera_capture(), it does not check the value of settings
before dereferencing it. And gb_camera_debugfs_capture calls
gb_camera_capture with the 6th parameter settings as NULL.

Fix this by checking the value of setting at the starting of

The req->settings pointer you're checking here is actually an
address.  It refers to the flexible array at the end of the
gb_camera_capture_request structure.  If the settings_size
argument is zero, nothing will be copied; otherwise no more
bytes will be copied than were allocated.  So your proposed
patch serves no purpose.

If you really want to improve this bit of code, I'd suggest
calling struct_size(req, settings, settings_size) rather
than manually computing it in the assignment to req_size.

And...  if you do that, look for other places to do that in
the Greybus code--and plan to fix them all.


Fixes: 3265edaf0d70 ("greybus: Add driver for the camera class protocol")
Signed-off-by: Dongliang Mu <dzm91@xxxxxxxxxxx>
  drivers/staging/greybus/camera.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/greybus/camera.c b/drivers/staging/greybus/camera.c
index cdbb42cd413b..5a4b26e7f645 100644
--- a/drivers/staging/greybus/camera.c
+++ b/drivers/staging/greybus/camera.c
@@ -659,7 +659,7 @@ static int gb_camera_capture(struct gb_camera *gcam, u32 request_id,
  	size_t req_size;
  	int ret;
- if (settings_size > GB_CAMERA_MAX_SETTINGS_SIZE)
+	if (settings_size > GB_CAMERA_MAX_SETTINGS_SIZE || !settings)
  		return -EINVAL;
req_size = sizeof(*req) + settings_size;

greybus-dev mailing list -- greybus-dev@xxxxxxxxxxxxxxxx
To unsubscribe send an email to greybus-dev-leave@xxxxxxxxxxxxxxxx

[Index of Archives]     [Asterisk App Development]     [PJ SIP]     [Gnu Gatekeeper]     [IETF Sipping]     [Info Cyrus]     [ALSA User]     [Fedora Linux Users]     [Linux SCTP]     [DCCP]     [Gimp]     [Yosemite News]     [Deep Creek Hot Springs]     [Yosemite Campsites]     [ISDN Cause Codes]     [Asterisk Books]

  Powered by Linux