From patchwork Mon Jul 12 06:06:12 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 472951 Delivered-To: patch@linaro.org Received: by 2002:a02:c94a:0:0:0:0:0 with SMTP id u10csp2674381jao; Mon, 12 Jul 2021 00:11:21 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxnBYtqvSFlRAMh79T2QHWjCieTDaDgd8lVYaRPMCASRn6om2pewBizpF0AbQwuUcQ1S2MO X-Received: by 2002:a05:6e02:1091:: with SMTP id r17mr21565219ilj.160.1626073881480; Mon, 12 Jul 2021 00:11:21 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1626073881; cv=none; d=google.com; s=arc-20160816; b=CbSYa1m2FirPb8oF9HKmHksdxNVa8RxSWxzujnNsufz9kaPlWyGg0+1JkW5L1oFKPW MGDCTKxI6A9a9tUY6ZPnTPspfzZJxO3Iln0Uqx0R0VZBLCWeauZqIe7+mGQnFj40dJpS wSa8p+xp7DI9Y7d1LmohqXPYHRIWGhGzCGkbWriYgsMYFaAvX/5HPwfLKXDuLBapWTqM JfsJNlES8L6slfdC04KGJEHzTSZ39ebgBhlkyD9hCBHMYtGZrOkpi+c7IJGinEtIl3jK BOPRogNcmacaLp6nbDrxhg+8/DAtM0LvTldXtIk/gM12JRdzRh/qSGptAQ5Ie6hhmMYn Ihvg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=5pKAPIgwRV8UemgupFtFNTeSmUlryq5DF8pgH0NHc+I=; b=oanegDbLvXkgNucNNOf1yQ4etmyxsT12ELrEcXw92fdinC/fecZaFCF0I/crzdtC7+ KY6mLykCKIlKByl7BIPWCO4CfOkN89oaugdrq0WRwin19h74FwfXgWSxoqpqYKS6o12U CSXTN6Zyto8sKD0Fi75uZx+2k00E2Yody75oa/gA/HwyY0vCtHl/2ouDspsyjnttCL57 kPDQdBXIYh3wYVemSlh6+3X0fkHg5LQVN250U4mvnosahFSo8eGOtguglmqdnaRLOgNP 8YyZh3B3ZckrxuC8iw+k7Rd8Qw98z3vpUss5w7TOrEr1PYfmhdD4j8IrIH67bVRSdUDs vVWA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=m3U5bpdF; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id g12si16580694jas.65.2021.07.12.00.11.21; Mon, 12 Jul 2021 00:11:21 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=m3U5bpdF; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242402AbhGLHL5 (ORCPT + 12 others); Mon, 12 Jul 2021 03:11:57 -0400 Received: from mail.kernel.org ([198.145.29.99]:43022 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S244133AbhGLHK0 (ORCPT ); Mon, 12 Jul 2021 03:10:26 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 2E64261186; Mon, 12 Jul 2021 07:06:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1626073580; bh=BtWqfh2M0s3HQoGaomlcmC8sxmlBexek3yVLfsONMas=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=m3U5bpdF9Y5wyzL+CSP1UesvwWfIEnOEQPwTg7Ygk8rr8pE5qB8hNK/eBkv06lRMl PtQ+9Z2xyETtQSzEwcMiDNULLr8d2UlvVUy6yd7WGsK8SC1TeyneWDDHhwM8b/Lynj t4IbQ4mpxqR4TlcGfgHNvjsftpWYFM21xTUKI8Sw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+142888ffec98ab194028@syzkaller.appspotmail.com, Arnd Bergmann , Laurent Pinchart , Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 5.12 289/700] media: v4l2-core: ignore native time32 ioctls on 64-bit Date: Mon, 12 Jul 2021 08:06:12 +0200 Message-Id: <20210712061006.977668145@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210712060924.797321836@linuxfoundation.org> References: <20210712060924.797321836@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Arnd Bergmann [ Upstream commit c344f07aa1b4ba38ca8fabe407a2afe2f436323c ] Syzbot found that passing ioctl command 0xc0505609 into a 64-bit kernel from a 32-bit process causes uninitialized kernel memory to get passed to drivers instead of the user space data: BUG: KMSAN: uninit-value in check_array_args drivers/media/v4l2-core/v4l2-ioctl.c:3041 [inline] BUG: KMSAN: uninit-value in video_usercopy+0x1631/0x3d30 drivers/media/v4l2-core/v4l2-ioctl.c:3315 CPU: 0 PID: 19595 Comm: syz-executor.4 Not tainted 5.11.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x21c/0x280 lib/dump_stack.c:120 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x5f/0xa0 mm/kmsan/kmsan_instr.c:197 check_array_args drivers/media/v4l2-core/v4l2-ioctl.c:3041 [inline] video_usercopy+0x1631/0x3d30 drivers/media/v4l2-core/v4l2-ioctl.c:3315 video_ioctl2+0x9f/0xb0 drivers/media/v4l2-core/v4l2-ioctl.c:3391 v4l2_ioctl+0x255/0x290 drivers/media/v4l2-core/v4l2-dev.c:360 v4l2_compat_ioctl32+0x2c6/0x370 drivers/media/v4l2-core/v4l2-compat-ioctl32.c:1248 __do_compat_sys_ioctl fs/ioctl.c:842 [inline] __se_compat_sys_ioctl+0x53d/0x1100 fs/ioctl.c:793 __ia32_compat_sys_ioctl+0x4a/0x70 fs/ioctl.c:793 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] __do_fast_syscall_32+0x102/0x160 arch/x86/entry/common.c:141 do_fast_syscall_32+0x6a/0xc0 arch/x86/entry/common.c:166 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:209 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c The time32 commands are defined but were never meant to be called on 64-bit machines, as those have always used time64 interfaces. I missed this in my patch that introduced the time64 handling on 32-bit platforms. The problem in this case is the mismatch of one function checking for the numeric value of the command and another function checking for the type of process (native vs compat) instead, with the result being that for this combination, nothing gets copied into the buffer at all. Avoid this by only trying to convert the time32 commands when running on a 32-bit kernel where these are defined in a meaningful way. [hverkuil: fix 3 warnings: switch with no cases] Fixes: 577c89b0ce72 ("media: v4l2-core: fix v4l2_buffer handling for time64 ABI") Reported-by: syzbot+142888ffec98ab194028@syzkaller.appspotmail.com Signed-off-by: Arnd Bergmann Reviewed-by: Laurent Pinchart Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin --- drivers/media/v4l2-core/v4l2-ioctl.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) -- 2.30.2 diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c index 31d1342e61e8..7e8bf4b1ab2e 100644 --- a/drivers/media/v4l2-core/v4l2-ioctl.c +++ b/drivers/media/v4l2-core/v4l2-ioctl.c @@ -3114,8 +3114,8 @@ static int check_array_args(unsigned int cmd, void *parg, size_t *array_size, static unsigned int video_translate_cmd(unsigned int cmd) { +#if !defined(CONFIG_64BIT) && defined(CONFIG_COMPAT_32BIT_TIME) switch (cmd) { -#ifdef CONFIG_COMPAT_32BIT_TIME case VIDIOC_DQEVENT_TIME32: return VIDIOC_DQEVENT; case VIDIOC_QUERYBUF_TIME32: @@ -3126,8 +3126,8 @@ static unsigned int video_translate_cmd(unsigned int cmd) return VIDIOC_DQBUF; case VIDIOC_PREPARE_BUF_TIME32: return VIDIOC_PREPARE_BUF; -#endif } +#endif if (in_compat_syscall()) return v4l2_compat_translate_cmd(cmd); @@ -3168,8 +3168,8 @@ static int video_get_user(void __user *arg, void *parg, } else if (in_compat_syscall()) { err = v4l2_compat_get_user(arg, parg, cmd); } else { +#if !defined(CONFIG_64BIT) && defined(CONFIG_COMPAT_32BIT_TIME) switch (cmd) { -#ifdef CONFIG_COMPAT_32BIT_TIME case VIDIOC_QUERYBUF_TIME32: case VIDIOC_QBUF_TIME32: case VIDIOC_DQBUF_TIME32: @@ -3197,8 +3197,8 @@ static int video_get_user(void __user *arg, void *parg, }; break; } -#endif } +#endif } /* zero out anything we don't copy from userspace */ @@ -3223,8 +3223,8 @@ static int video_put_user(void __user *arg, void *parg, if (in_compat_syscall()) return v4l2_compat_put_user(arg, parg, cmd); +#if !defined(CONFIG_64BIT) && defined(CONFIG_COMPAT_32BIT_TIME) switch (cmd) { -#ifdef CONFIG_COMPAT_32BIT_TIME case VIDIOC_DQEVENT_TIME32: { struct v4l2_event *ev = parg; struct v4l2_event_time32 ev32; @@ -3272,8 +3272,8 @@ static int video_put_user(void __user *arg, void *parg, return -EFAULT; break; } -#endif } +#endif return 0; }