Fixing Mauro's e-mail address... On Wed, Apr 06, 2016 at 02:46:06PM +0300, Sakari Ailus wrote: > Hi all, > > In multi-planar API, the buffer length and m.planes fields are checked > against the vb2 buffer before passing the buffer on to the core, but > commit b0e0e1f83de31aa0428c38b692c590cc0ecd3f03 removed this check from > VIDIOC_DQBUF path. This leads to kernel memory overwriting in certain > cases. > > This affects only v4.4 and newer and a very few drivers which use the > multi-planar API. Due to the very limited scope of the issue this is not > seen to require special handling. > > The patches should be applied to the stable series, I'll add cc stable > in the pull request. > > -- > Kind regards, > Sakari > > -- > To unsubscribe from this list: send the line "unsubscribe linux-media" in > the body of a message to majordomo@xxxxxxxxxxxxxxx > More majordomo info at http://vger.kernel.org/majordomo-info.html -- Sakari Ailus e-mail: sakari.ailus@xxxxxx XMPP: sailus@xxxxxxxxxxxxxx -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
