Backport CVE-2017-13166 fixes to Kernel 3.18
Status from this message: This is a note to let you know that I've just added the patch titled
Get series with b4
b4 am [email protected]Versions newest first
Patches in v1 Applied
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/18 | media: v4l2-ioctl.c: don't copy back the result for -ENOTTYdrivers/ | +4 | 0 replies | |
| 2/18 | vb2: V4L2_BUF_FLAG_DONE is set after DQBUFdrivers/ | +5 | 0 replies | |
| 3/18 | media: v4l2-compat-ioctl32.c: add missing VIDIOC_PREPARE_BUFdrivers/ | +1 | 0 replies | |
| 4/18 | media: v4l2-compat-ioctl32.c: fix the indentationdrivers/ | +108 | 0 replies | |
| 5/18 | media: v4l2-compat-ioctl32.c: move 'helper' functions to __get/put_v4l2_format32drivers/ | +16 | 1 reply | |
| 6/18 | media: v4l2-compat-ioctl32.c: avoid sizeof(type)drivers/ | +38 | 1 reply | |
| 7/18 | media: v4l2-compat-ioctl32.c: copy m.userptr in put_v4l2_plane32drivers/ | +28 | 1 reply | |
| 8/18 | media: v4l2-compat-ioctl32.c: fix ctrl_is_pointerdrivers/ | +38 | 1 reply | |
| 9/18 | media: v4l2-compat-ioctl32.c: make ctrl_is_pointer work for subdevsdrivers/ | +1 | 1 reply | |
| 10/18 | media: v4l2-compat-ioctl32: Copy v4l2_window->global_alphadrivers/ | +5 | 1 reply | |
| 11/18 | media: v4l2-compat-ioctl32.c: copy clip list in put_v4l2_window32drivers/ | +41 | 1 reply | |
| 12/18 | media: v4l2-compat-ioctl32.c: drop pr_info for unknown buffer typedrivers/ | +0 | 1 reply | |
| 13/18 | media: v4l2-compat-ioctl32.c: don't copy back the result for certain errorsdrivers/ | +3 | 1 reply | |
| 14/18 | media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logicdrivers/ | +486 | 1 reply | |
| 15/18 | media: v4l2-ctrls: fix sparse warningdrivers/ | +52 | 1 reply | |
| 16/18 | media: media/v4l2-ctrls: volatiles should not generate CH_VALUEdrivers/ | +9 | 1 reply | |
| 17/18 | media: v4l2-compat-ioctl32: use compat_u64 for video standarddrivers/ | +1 | 1 reply | |
| 18/18 | media: v4l2-compat-ioctl32: initialize a reserved fielddrivers/ | +2 | 1 reply |
Reviews trailers per patch
12 of 18 patches have a Reviewed-by or Acked-by.
| Patch | Sakari Ailus | Laurent Pinchart |
|---|---|---|
| 1/18 | A-b | |
| 2/18 | ||
| 3/18 | A-b | |
| 4/18 | A-b | |
| 5/18 | A-b A-b | |
| 6/18 | A-b A-b | |
| 7/18 | A-b A-b | |
| 8/18 | A-b A-b | |
| 9/18 | A-b A-b | R-b R-b |
| 10/18 | ||
| 11/18 | A-b A-b | |
| 12/18 | A-b A-b | |
| 13/18 | A-b A-b | |
| 14/18 | A-b A-b | |
| 15/18 | ||
| 16/18 | ||
| 17/18 | ||
| 18/18 |
Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.
Cover letter [PATCH for v3.18 00/18] Backport CVE-2017-13166 fixes to Kernel 3.18
Hi Greg,
Those are the backports meant to solve CVE-2017-13166 on Kernel 3.18.
It contains two v4l2-ctrls fixes that are required to avoid crashes at the test application.
I wrote two patches myself for Kernel 3.18 in order to solve some issues specific for Kernel 3.18 with aren't needed upstream. one is actually a one-line change backport. The other one makes sure that both 32-bits and 64-bits version of some ioctl calls will return the same value for a reserved field.
I noticed an extra bug while testing it, but the bug also hits upstream, and should be backported all the way down all stable/LTS versions. So, I'll send it the usual way, after merging upsream.
Regards,
Mauro
Daniel Mentz (2):
media: v4l2-compat-ioctl32: Copy v4l2_window->global_alpha
media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic
Hans Verkuil (12):
media: v4l2-ioctl.c: don't copy back the result for -ENOTTY
media: v4l2-compat-ioctl32.c: add missing VIDIOC_PREPARE_BUF
media: v4l2-compat-ioctl32.c: fix the indentation
media: v4l2-compat-ioctl32.c: move 'helper' functions to
__get/put_v4l2_format32
media: v4l2-compat-ioctl32.c: avoid sizeof(type)
media: v4l2-compat-ioctl32.c: copy m.userptr in put_v4l2_plane32
media: v4l2-compat-ioctl32.c: fix ctrl_is_pointer
media: v4l2-compat-ioctl32.c: make ctrl_is_pointer work for subdevs
media: v4l2-compat-ioctl32.c: copy clip list in put_v4l2_window32
media: v4l2-compat-ioctl32.c: drop pr_info for unknown buffer type
media: v4l2-compat-ioctl32.c: don't copy back the result for certain
errors
media: v4l2-ctrls: fix sparse warning
Mauro Carvalho Chehab (2):
media: v4l2-compat-ioctl32: use compat_u64 for video standard
media: v4l2-compat-ioctl32: initialize a reserved field
Ricardo Ribalda (2):
vb2: V4L2_BUF_FLAG_DONE is set after DQBUF
media: media/v4l2-ctrls: volatiles should not generate CH_VALUE
drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 1020 +++++++++++++++---------- drivers/media/v4l2-core/v4l2-ctrls.c | 96 ++- drivers/media/v4l2-core/v4l2-ioctl.c | 5 +- drivers/media/v4l2-core/videobuf2-core.c | 5 + 4 files changed, 691 insertions(+), 435 deletions(-)
Signature · 1 line
2.14.3