Skip to content

Backport CVE-2017-13166 fixes to Kernel 3.18

Mauro Carvalho Chehab linux-media lkml stable 1 version Applied

Status from this message: This is a note to let you know that I've just added the patch titled

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 Latest18 patches 21 repliesApplied

Patches in v1 Applied

#Subject and filesSizeRepliesApplied
1/18media: v4l2-ioctl.c: don't copy back the result for -ENOTTYdrivers/media/v4l2-core/v4l2-ioctl.c+4 -10 replies
2/18vb2: V4L2_BUF_FLAG_DONE is set after DQBUFdrivers/media/v4l2-core/videobuf2-core.c+5 -00 replies
3/18media: v4l2-compat-ioctl32.c: add missing VIDIOC_PREPARE_BUFdrivers/media/v4l2-core/v4l2-compat-ioctl32.c+1 -00 replies
4/18media: v4l2-compat-ioctl32.c: fix the indentationdrivers/media/v4l2-core/v4l2-compat-ioctl32.c+108 -1080 replies
5/18media: v4l2-compat-ioctl32.c: move 'helper' functions to __get/put_v4l2_format32drivers/media/v4l2-core/v4l2-compat-ioctl32.c+16 -681 reply
6/18media: v4l2-compat-ioctl32.c: avoid sizeof(type)drivers/media/v4l2-core/v4l2-compat-ioctl32.c+38 -421 reply
7/18media: v4l2-compat-ioctl32.c: copy m.userptr in put_v4l2_plane32drivers/media/v4l2-core/v4l2-compat-ioctl32.c+28 -191 reply
8/18media: v4l2-compat-ioctl32.c: fix ctrl_is_pointerdrivers/media/v4l2-core/v4l2-compat-ioctl32.c+38 -191 reply
9/18media: v4l2-compat-ioctl32.c: make ctrl_is_pointer work for subdevsdrivers/media/v4l2-core/v4l2-compat-ioctl32.c+1 -11 reply
10/18media: v4l2-compat-ioctl32: Copy v4l2_window->global_alphadrivers/media/v4l2-core/v4l2-compat-ioctl32.c+5 -21 reply
11/18media: v4l2-compat-ioctl32.c: copy clip list in put_v4l2_window32drivers/media/v4l2-core/v4l2-compat-ioctl32.c+41 -201 reply
12/18media: v4l2-compat-ioctl32.c: drop pr_info for unknown buffer typedrivers/media/v4l2-core/v4l2-compat-ioctl32.c+0 -41 reply
13/18media: v4l2-compat-ioctl32.c: don't copy back the result for certain errorsdrivers/media/v4l2-core/v4l2-compat-ioctl32.c+3 -01 reply
14/18media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logicdrivers/media/v4l2-core/v4l2-compat-ioctl32.c+486 -2611 reply
15/18media: v4l2-ctrls: fix sparse warningdrivers/media/v4l2-core/v4l2-ctrls.c+52 -351 reply
16/18media: media/v4l2-ctrls: volatiles should not generate CH_VALUEdrivers/media/v4l2-core/v4l2-ctrls.c+9 -01 reply
17/18media: v4l2-compat-ioctl32: use compat_u64 for video standarddrivers/media/v4l2-core/v4l2-compat-ioctl32.c+1 -11 reply
18/18media: v4l2-compat-ioctl32: initialize a reserved fielddrivers/media/v4l2-core/v4l2-compat-ioctl32.c+2 -11 reply

Reviews trailers per patch

12 of 18 patches have a Reviewed-by or Acked-by.

PatchSakari AilusLaurent Pinchart
1/18A-b
2/18
3/18A-b
4/18A-b
5/18A-b A-b
6/18A-b A-b
7/18A-b A-b
8/18A-b A-b
9/18A-b A-b R-b R-b
10/18
11/18A-b A-b
12/18A-b A-b
13/18A-b A-b
14/18A-b A-b
15/18
16/18
17/18
18/18

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.

Read the v1 thread

Cover letter [PATCH for v3.18 00/18] Backport CVE-2017-13166 fixes to Kernel 3.18

Hi Greg,

Those are the backports meant to solve CVE-2017-13166 on Kernel 3.18.

It contains two v4l2-ctrls fixes that are required to avoid crashes at the test application.

I wrote two patches myself for Kernel 3.18 in order to solve some issues specific for Kernel 3.18 with aren't needed upstream. one is actually a one-line change backport. The other one makes sure that both 32-bits and 64-bits version of some ioctl calls will return the same value for a reserved field.

I noticed an extra bug while testing it, but the bug also hits upstream, and should be backported all the way down all stable/LTS versions. So, I'll send it the usual way, after merging upsream.

Regards,
Mauro

Daniel Mentz (2):
media: v4l2-compat-ioctl32: Copy v4l2_window->global_alpha
media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic

Hans Verkuil (12):
media: v4l2-ioctl.c: don't copy back the result for -ENOTTY
media: v4l2-compat-ioctl32.c: add missing VIDIOC_PREPARE_BUF
media: v4l2-compat-ioctl32.c: fix the indentation
media: v4l2-compat-ioctl32.c: move 'helper' functions to

    __get/put_v4l2_format32

media: v4l2-compat-ioctl32.c: avoid sizeof(type)
media: v4l2-compat-ioctl32.c: copy m.userptr in put_v4l2_plane32
media: v4l2-compat-ioctl32.c: fix ctrl_is_pointer
media: v4l2-compat-ioctl32.c: make ctrl_is_pointer work for subdevs
media: v4l2-compat-ioctl32.c: copy clip list in put_v4l2_window32
media: v4l2-compat-ioctl32.c: drop pr_info for unknown buffer type
media: v4l2-compat-ioctl32.c: don't copy back the result for certain
errors
media: v4l2-ctrls: fix sparse warning

Mauro Carvalho Chehab (2):
media: v4l2-compat-ioctl32: use compat_u64 for video standard
media: v4l2-compat-ioctl32: initialize a reserved field

Ricardo Ribalda (2):
vb2: V4L2_BUF_FLAG_DONE is set after DQBUF
media: media/v4l2-ctrls: volatiles should not generate CH_VALUE

 drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 1020 +++++++++++++++----------
 drivers/media/v4l2-core/v4l2-ctrls.c          |   96 ++-
 drivers/media/v4l2-core/v4l2-ioctl.c          |    5 +-
 drivers/media/v4l2-core/videobuf2-core.c      |    5 +
 4 files changed, 691 insertions(+), 435 deletions(-)
Signature · 1 line
2.14.3