On 1/14/21 12:50 PM, Bingbu Cao wrote:
> Sakari,
>
> On 12/21/20 4:11 AM, Sakari Ailus wrote:
>> When an IOCTL with argument size larger than 128 that also used array
>> arguments were handled, two memory allocations were made but alas, only
>> the latter one of them was released. This happened because there was only
>> a single local variable to hold such a temporary allocation.
>>
>> Fix this by adding separate variables to hold the pointers to the
>> temporary allocations.
>>
>> Reported-by: Arnd Bergmann <arnd@xxxxxxxxxx>
>> Reported-by: syzbot+1115e79c8df6472c612b@xxxxxxxxxxxxxxxxxxxxxxxxx
>> Fixes: d14e6d76ebf7 ("[media] v4l: Add multi-planar ioctl handling code")
>> Cc: stable@xxxxxxxxxxxxxxx
>> Signed-off-by: Sakari Ailus <sakari.ailus@xxxxxxxxxxxxxxx>
>> Reviewed-by: Laurent Pinchart <laurent.pinchart@xxxxxxxxxxxxxxxx>
>> ---
>> drivers/media/v4l2-core/v4l2-ioctl.c | 32 ++++++++++++----------------
>> 1 file changed, 14 insertions(+), 18 deletions(-)
>>
>> diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
>> index 3198abdd538c..9906b41004e9 100644
>> --- a/drivers/media/v4l2-core/v4l2-ioctl.c
>> +++ b/drivers/media/v4l2-core/v4l2-ioctl.c
>> @@ -3283,7 +3283,7 @@ video_usercopy(struct file *file, unsigned int orig_cmd, unsigned long arg,
>> v4l2_kioctl func)
>> {
>> char sbuf[128];
>> - void *mbuf = NULL;
>> + void *mbuf = NULL, *array_buf = NULL;
>> void *parg = (void *)arg;
>> long err = -EINVAL;
>> bool has_array_args;
>> @@ -3318,27 +3318,21 @@ video_usercopy(struct file *file, unsigned int orig_cmd, unsigned long arg,
>> has_array_args = err;
>>
>> if (has_array_args) {
>> - /*
>> - * When adding new types of array args, make sure that the
>> - * parent argument to ioctl (which contains the pointer to the
>> - * array) fits into sbuf (so that mbuf will still remain
>> - * unused up to here).
>> - */
>> - mbuf = kvmalloc(array_size, GFP_KERNEL);
>> + array_buf = kvmalloc(array_size, GFP_KERNEL);
>> err = -ENOMEM;
>> - if (NULL == mbuf)
>> + if (array_buf == NULL)
>
> if (!array_buf)
> ?
>
Please ignore my previous comment, as the patch was landed. :)
....
--
Best regards,
Bingbu Cao
