Re: [PATCH 2/3] videobuf2-dma-sg: Prevent size from overflowing

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, Dec 13, 2018 at 03:03:47PM +0200, Laurent Pinchart wrote:
> On Thursday, 13 December 2018 15:00:23 EET Sakari Ailus wrote:
> > Hi Laurent,
> > 
> > On Thu, Dec 13, 2018 at 02:57:46PM +0200, Laurent Pinchart wrote:
> > > Hi Sakari,
> > > 
> > > Thank you for the patch.
> > > 
> > > On Thursday, 13 December 2018 12:40:05 EET Sakari Ailus wrote:
> > > > buf->size is an unsigned long; casting that to int will lead to an
> > > > overflow if buf->size exceeds INT_MAX.
> > > > 
> > > > Fix this by changing the type to unsigned long instead. This is possible
> > > > as the buf->size is always aligned to PAGE_SIZE, and therefore the size
> > > > will never have values lesser than 0.
> > > 
> > > This feels a bit fragile to me. We at least need a big comment in the code
> > > to explain this. Another option would be a size -= min(..., size) just to
> > > make sure.
> > 
> > I was thinking of something like:
> > 
> > 	if (WARN_ON(size & ~PAGE_MASK))
> > 		return -ENOMEM;
> > 
> > But I opted to writing the third patch as this is not the only place where
> > the page alignment could be relevant.
> > 
> > What do you think?
> 
> I'd do both :-)

Then my next question is: as this is relevant elsewhere, too, where else
should I add a similar check?

This is just the SG DMA implementation...

> 
> > > > Note on backporting to stable: the file used to be under
> > > > drivers/media/v4l2-core, it was moved to the current location after
> > > > 4.14.
> > > > 
> > > > Signed-off-by: Sakari Ailus <sakari.ailus@xxxxxxxxxxxxxxx>
> > > > Cc: stable@xxxxxxxxxxxxxxx
> > > > ---
> > > > 
> > > >  drivers/media/common/videobuf2/videobuf2-dma-sg.c | 2 +-
> > > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > > 
> > > > diff --git a/drivers/media/common/videobuf2/videobuf2-dma-sg.c
> > > > b/drivers/media/common/videobuf2/videobuf2-dma-sg.c index
> > > > 015e737095cdd..e9bfea986cc47 100644
> > > > --- a/drivers/media/common/videobuf2/videobuf2-dma-sg.c
> > > > +++ b/drivers/media/common/videobuf2/videobuf2-dma-sg.c
> > > > @@ -59,7 +59,7 @@ static int vb2_dma_sg_alloc_compacted(struct
> > > > vb2_dma_sg_buf *buf, gfp_t gfp_flags)
> > > > 
> > > >  {
> > > >  
> > > >  	unsigned int last_page = 0;
> > > > 
> > > > -	int size = buf->size;
> > > > +	unsigned long size = buf->size;
> > > > 
> > > >  	while (size > 0) {
> > > >  	
> > > >  		struct page *pages;
> 
> 
> -- 
> Regards,
> 
> Laurent Pinchart
> 
> 
> 

-- 
Sakari Ailus
sakari.ailus@xxxxxxxxxxxxxxx



[Index of Archives]     [Linux Input]     [Video for Linux]     [Gstreamer Embedded]     [Mplayer Users]     [Linux USB Devel]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Yosemite Backpacking]

  Powered by Linux