• Sakari Ailus's avatar
    [media] videobuf2-v4l2: Verify planes array in buffer dequeueing · 2c1f6951
    Sakari Ailus authored
    When a buffer is being dequeued using VIDIOC_DQBUF IOCTL, the exact buffer
    which will be dequeued is not known until the buffer has been removed from
    the queue. The number of planes is specific to a buffer, not to the queue.
    
    This does lead to the situation where multi-plane buffers may be requested
    and queued with n planes, but VIDIOC_DQBUF IOCTL may be passed an argument
    struct with fewer planes.
    
    __fill_v4l2_buffer() however uses the number of planes from the dequeued
    videobuf2 buffer, overwriting kernel memory (the m.planes array allocated
    in video_usercopy() in v4l2-ioctl.c)  if the user provided fewer
    planes than the dequeued buffer had. Oops!
    
    Fixes: b0e0e1f8 ("[media] media: videobuf2: Prepare to divide videobuf2")
    Signed-off-by: default avatarSakari Ailus <sakari.ailus@linux.intel.com>
    Acked-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
    Cc: stable@vger.kernel.org # for v4.4 and later
    Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
    2c1f6951
videobuf2-v4l2.c 31.6 KB