Hi Hans,
Thank you for the patch.
On Mon, Mar 21, 2022 at 09:33:56AM +0100, Hans Verkuil wrote:
> The v4l2_compat_get_array_args() function can leave uninitialized memory in the
> buffer it is passed. So zero it before copying array elements from userspace
> into the buffer.
>
> Signed-off-by: Hans Verkuil <hverkuil-cisco@xxxxxxxxx>
> Reported-by: syzbot+ff18193ff05f3f87f226@xxxxxxxxxxxxxxxxxxxxxxxxx
Reviewed-by: Laurent Pinchart <laurent.pinchart@xxxxxxxxxxxxxxxx>
> ---
> diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> index 0f3d6b5667b0..55c26e7d370e 100644
> --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> @@ -1040,6 +1040,8 @@ int v4l2_compat_get_array_args(struct file *file, void *mbuf,
> {
> int err = 0;
>
> + memset(mbuf, 0, array_size);
> +
> switch (cmd) {
> case VIDIOC_G_FMT32:
> case VIDIOC_S_FMT32:
--
Regards,
Laurent Pinchart
