Files
linux/include/uapi/linux
Kees Cook d4568fc852 media: omap3isp: Use struct_group() for memcpy() region
In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memcpy(), memmove(), and memset(), avoid
intentionally writing across neighboring fields. Wrap the target region
in struct_group(). This additionally fixes a theoretical misalignment
of the copy (since the size of "buf" changes between 64-bit and 32-bit,
but this is likely never built for 64-bit).

FWIW, I think this code is totally broken on 64-bit (which appears to
not be a "real" build configuration): it would either always fail (with
an uninitialized data->buf_size) or would cause corruption in userspace
due to the copy_to_user() in the call path against an uninitialized
data->buf value:

omap3isp_stat_request_statistics_time32(...)
    struct omap3isp_stat_data data64;
    ...
    omap3isp_stat_request_statistics(stat, &data64);

int omap3isp_stat_request_statistics(struct ispstat *stat,
                                     struct omap3isp_stat_data *data)
    ...
    buf = isp_stat_buf_get(stat, data);

static struct ispstat_buffer *isp_stat_buf_get(struct ispstat *stat,
                                               struct omap3isp_stat_data *data)
...
    if (buf->buf_size > data->buf_size) {
            ...
            return ERR_PTR(-EINVAL);
    }
    ...
    rval = copy_to_user(data->buf,
                        buf->virt_addr,
                        buf->buf_size);

Regardless, additionally initialize data64 to be zero-filled to avoid
undefined behavior.

Link: https://lore.kernel.org/lkml/20211215220505.GB21862@embeddedor

Cc: Arnd Bergmann <arnd@arndb.de>
Fixes: 378e3f81cb ("media: omap3isp: support 64-bit version of omap3isp_stat_data")
Cc: stable@vger.kernel.org
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-02-17 09:56:02 +01:00
..
2021-09-14 08:46:08 +02:00
2021-01-25 18:44:44 +01:00
2020-05-28 11:22:14 +02:00
2020-12-28 14:21:31 +00:00
2019-12-18 18:07:31 +01:00
2021-11-01 13:36:08 +00:00
2020-08-12 10:58:00 -07:00
2020-10-09 12:47:02 -06:00
2021-10-29 12:38:43 +02:00
2019-10-09 22:31:14 -04:00
2019-09-25 17:51:39 -07:00
2021-11-26 16:48:59 +01:00
2019-08-02 14:44:02 +10:00
2021-08-10 13:32:40 -04:00
2020-07-19 19:20:22 -07:00
2020-06-24 21:34:11 +02:00
2020-05-14 16:44:25 +02:00
2021-10-07 13:51:11 +02:00
2021-02-08 13:01:24 +01:00
2021-10-06 12:05:51 +00:00
2021-11-15 07:53:10 -08:00
2021-06-03 15:31:34 -07:00
2021-12-02 12:07:04 +00:00
2020-07-13 15:32:56 -07:00
2020-04-20 12:43:24 -07:00
2021-02-26 09:41:03 -08:00
2020-05-21 08:20:35 -06:00
2021-03-10 09:34:06 +01:00
2021-10-26 14:58:45 +01:00
2020-08-18 15:44:44 +02:00
2021-10-14 23:06:28 +02:00
2021-07-06 10:37:46 -05:00
2019-10-02 20:32:27 -06:00
2019-07-30 20:34:34 +02:00
2020-03-29 22:30:57 -07:00
2021-10-18 17:20:50 +02:00
2021-03-10 09:34:06 +01:00
2021-01-07 16:17:32 +01:00
2021-09-16 14:36:26 +01:00
2019-12-09 09:59:07 +01:00
2020-03-29 23:29:08 +02:00
2020-10-23 11:55:28 -04:00
2020-10-23 11:55:28 -04:00
2019-08-01 21:49:46 +02:00
2021-06-12 13:16:45 -07:00
2020-07-13 15:32:56 -07:00