On 21/03/2022 09:33, Hans Verkuil wrote:
> The v4l2_compat_get_array_args() function can leave uninitialized memory in the
> buffer it is passed. So zero it before copying array elements from userspace
> into the buffer.
>
> Signed-off-by: Hans Verkuil <hverkuil-cisco@xxxxxxxxx>
> Reported-by: syzbot+ff18193ff05f3f87f226@xxxxxxxxxxxxxxxxxxxxxxxxx
Fixes: 8dbcc3fa387c (media: v4l2: prepare compat-ioctl rework)
> ---
> diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> index 0f3d6b5667b0..55c26e7d370e 100644
> --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> @@ -1040,6 +1040,8 @@ int v4l2_compat_get_array_args(struct file *file, void *mbuf,
> {
> int err = 0;
>
> + memset(mbuf, 0, array_size);
> +
> switch (cmd) {
> case VIDIOC_G_FMT32:
> case VIDIOC_S_FMT32:
