Re: [PATCH] media: v4l: subdev: Prevent NULL routes access

[Cosmin Tanislav <demonsingur@xxxxxxxxx>]

On 11/24/24 8:49 AM, Laurent Pinchart wrote:
> On Fri, Nov 22, 2024 at 04:37:12PM +0200, Cosmin Tanislav wrote:
> > When using v4l2_subdev_set_routing to set a subdev's routing, and the
> > passed routing.num_routes is 0, kmemdup is not called to populate the
> > routes of the new routing (which is fine, since we wouldn't want to pass
> > a possible NULL value to kmemdup).
> >
> > This results in subdev's routing.routes to be NULL.
> >
> > routing.routes is further used in some places without being guarded by
> > the same num_routes non-zero condition.
>
> What other places is that ? Have you experienced a crash anywhere ?

The other places are exactly the ones being fixed in this patch. I can
probably reword it if it's unclear.

> > Fix it.
>
> A Fixes: tag would be good to help backporting.
>
> > Signed-off-by: Cosmin Tanislav <demonsingur@xxxxxxxxx>
> > ---
> >   drivers/media/v4l2-core/v4l2-subdev.c | 46 +++++++++++++--------------
> >   1 file changed, 23 insertions(+), 23 deletions(-)
> >
> > diff --git a/drivers/media/v4l2-core/v4l2-subdev.c b/drivers/media/v4l2-core/v4l2-subdev.c
> > index cde1774c9098d..4f0eecd7fd66f 100644
> > --- a/drivers/media/v4l2-core/v4l2-subdev.c
> > +++ b/drivers/media/v4l2-core/v4l2-subdev.c
> > @@ -605,6 +605,23 @@ subdev_ioctl_get_state(struct v4l2_subdev *sd, struct v4l2_subdev_fh *subdev_fh,
> >   			     v4l2_subdev_get_unlocked_active_state(sd);
> >   }
> >   
> > +static void subdev_copy_krouting(struct v4l2_subdev_routing *routing,
> > +				 struct v4l2_subdev_krouting *krouting)
>
> The second argument should be const.

Will do for V2.

> > +{
> > +	memset(routing->reserved, 0, sizeof(routing->reserved));
> > +
> > +	if (!krouting->routes) {
> > +		routing->num_routes = 0;
> > +		return;
> > +	}
> > +
> > +	memcpy((struct v4l2_subdev_route *)(uintptr_t)routing->routes,
> > +	       krouting->routes,
> > +	       min(krouting->num_routes, routing->len_routes) *
> > +	       sizeof(*krouting->routes));
> > +	routing->num_routes = krouting->num_routes;
> > +}
> > +
> >   static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
> >   			    struct v4l2_subdev_state *state)
> >   {
> > @@ -976,7 +993,6 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
> >   
> >   	case VIDIOC_SUBDEV_G_ROUTING: {
> >   		struct v4l2_subdev_routing *routing = arg;
> > -		struct v4l2_subdev_krouting *krouting;
> >   
> >   		if (!v4l2_subdev_enable_streams_api)
> >   			return -ENOIOCTLCMD;
> > @@ -984,15 +1000,7 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
> >   		if (!(sd->flags & V4L2_SUBDEV_FL_STREAMS))
> >   			return -ENOIOCTLCMD;
> >   
> > -		memset(routing->reserved, 0, sizeof(routing->reserved));
> > -
> > -		krouting = &state->routing;
> > -
> > -		memcpy((struct v4l2_subdev_route *)(uintptr_t)routing->routes,
> > -		       krouting->routes,
> > -		       min(krouting->num_routes, routing->len_routes) *
> > -		       sizeof(*krouting->routes));
> > -		routing->num_routes = krouting->num_routes;
> > +		subdev_copy_krouting(routing, &state->routing);
> >   
> >   		return 0;
> >   	}
> > @@ -1016,8 +1024,6 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
> >   		if (routing->num_routes > routing->len_routes)
> >   			return -EINVAL;
> >   
> > -		memset(routing->reserved, 0, sizeof(routing->reserved));
> > -
> >   		for (i = 0; i < routing->num_routes; ++i) {
> >   			const struct v4l2_subdev_route *route = &routes[i];
> >   			const struct media_pad *pads = sd->entity.pads;
> > @@ -1046,12 +1052,7 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
> >   		 * the routing table.
> >   		 */
> >   		if (!v4l2_subdev_has_op(sd, pad, set_routing)) {
> > -			memcpy((struct v4l2_subdev_route *)(uintptr_t)routing->routes,
> > -			       state->routing.routes,
> > -			       min(state->routing.num_routes, routing->len_routes) *
> > -			       sizeof(*state->routing.routes));
> > -			routing->num_routes = state->routing.num_routes;
> > -
> > +			subdev_copy_krouting(routing, &state->routing);
> >   			return 0;
> >   		}
> >   
> > @@ -1064,11 +1065,7 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
> >   		if (rval < 0)
> >   			return rval;
> >   
> > -		memcpy((struct v4l2_subdev_route *)(uintptr_t)routing->routes,
> > -		       state->routing.routes,
> > -		       min(state->routing.num_routes, routing->len_routes) *
> > -		       sizeof(*state->routing.routes));
> > -		routing->num_routes = state->routing.num_routes;
> > +		subdev_copy_krouting(routing, &state->routing);
> >   
> >   		return 0;
> >   	}
> > @@ -1956,6 +1953,9 @@ struct v4l2_subdev_route *
> >   __v4l2_subdev_next_active_route(const struct v4l2_subdev_krouting *routing,
> >   				struct v4l2_subdev_route *route)
> >   {
> > +	if (!routing->routes)
> > +		return NULL;
> > +
> >   	if (route)
> >   		++route;
> >   	else