Patch "media: imx-jpeg: Bounds check sizeimage access" has been added to the 6.3-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    media: imx-jpeg: Bounds check sizeimage access

to the 6.3-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     media-imx-jpeg-bounds-check-sizeimage-access.patch
and it can be found in the queue-6.3 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit b5a58ece097ab373fea56ccde7e57ede8d49359f
Author: Kees Cook <keescook@xxxxxxxxxxxx>
Date:   Sat Feb 4 19:38:05 2023 +0100

    media: imx-jpeg: Bounds check sizeimage access
    
    [ Upstream commit 474acc639fc8671fa4c1919d9e03253c82b6d321 ]
    
    The call of mxc_jpeg_get_plane_size() from mxc_jpeg_dec_irq() sets
    plane_no argument to 1. The compiler sees that it's possible to end up
    with an access beyond the bounds of sizeimage, if mem_planes was too
    large:
    
            if (plane_no >= fmt->mem_planes)        // mem_planes = 2+
                    return 0;
    
            if (fmt->mem_planes == fmt->comp_planes) // comp_planes != mem_planes
                    return q_data->sizeimage[plane_no];
    
            if (plane_no < fmt->mem_planes - 1)     // mem_planes = 2
                    return q_data->sizeimage[plane_no];
    
    comp_planes == 0 or 1 is safe. comp_planes > 2 would be out of bounds.
    
    (This isn't currently possible given the contents of mxc_formats, though.)
    
    Silence the warning by bounds checking comp_planes for future
    robustness. Seen with GCC 13:
    
    In function 'mxc_jpeg_get_plane_size',
        inlined from 'mxc_jpeg_dec_irq' at ../drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c:729:14:
    ../drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c:641:42: warning: array subscript 2 is above array bounds of 'u32[2]' {aka 'unsigned int[2]'} [-Warray-bounds=]
      641 |                 size += q_data->sizeimage[i];
          |                         ~~~~~~~~~~~~~~~~~^~~
    In file included from ../drivers/media/platform/nxp/imx-jpeg/mxc-jpeg-hw.h:112,
                     from ../drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c:63:
    ../drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.h: In function 'mxc_jpeg_dec_irq':
    ../drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.h:84:41: note: while referencing 'sizeimage'
       84 |         u32                             sizeimage[MXC_JPEG_MAX_PLANES];
          |                                         ^~~~~~~~~
    
    Cc: Mirela Rabulea <mirela.rabulea@xxxxxxx>
    Cc: NXP Linux Team <linux-imx@xxxxxxx>
    Cc: Shawn Guo <shawnguo@xxxxxxxxxx>
    Cc: Sascha Hauer <s.hauer@xxxxxxxxxxxxxx>
    Cc: Pengutronix Kernel Team <kernel@xxxxxxxxxxxxxx>
    Cc: Fabio Estevam <festevam@xxxxxxxxx>
    Cc: linux-arm-kernel@xxxxxxxxxxxxxxxxxxx
    Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
    Signed-off-by: Hans Verkuil <hverkuil-cisco@xxxxxxxxx>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
index f085f14d676ad..c898116b763a2 100644
--- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
+++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
@@ -637,6 +637,11 @@ static u32 mxc_jpeg_get_plane_size(struct mxc_jpeg_q_data *q_data, u32 plane_no)
 		return q_data->sizeimage[plane_no];
 
 	size = q_data->sizeimage[fmt->mem_planes - 1];
+
+	/* Should be impossible given mxc_formats. */
+	if (WARN_ON_ONCE(fmt->comp_planes > ARRAY_SIZE(q_data->sizeimage)))
+		return size;
+
 	for (i = fmt->mem_planes; i < fmt->comp_planes; i++)
 		size += q_data->sizeimage[i];