Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[LTS 9.2-RT] media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_… #129

Merged
merged 1 commit into from
Feb 14, 2025

Conversation

gvrose8192
Copy link
Collaborator

@gvrose8192 gvrose8192 commented Feb 13, 2025

jira VULN-9666
cve CVE-2024-53104
commit-author Benoit Sevens bsevens@google.com
commit ecf2b43

This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming.

Fixes: c0efd23 ("V4L/DVB (8145a): USB Video Class driver")
Signed-off-by: Benoit Sevens bsevens@google.com
Cc: stable@vger.kernel.org
Acked-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
Reviewed-by: Laurent Pinchart laurent.pinchart@ideasonboard.com
Signed-off-by: Hans Verkuil hverkuil@xs4all.nl
(cherry picked from commit ecf2b43)
Signed-off-by: Greg Rose g.v.rose@ciq.com

Builds and Loads

Your branch is up to date with 'origin/main'.
branch 'gvrose_ciqlts9_2-rt' set up to track 'origin/gvrose_ciqlts9_2-rt'.
Already up to date.
configs/kernel-rt-5.14.0-x86_64.config:CONFIG_PREEMPT_RT=y
configs/kernel-rt-5.14.0-x86_64-debug.config:CONFIG_PREEMPT_RT=y
skipkabi is true
/home/gvrose8192/prj/kernel-build-gvrose_ciqlts9_2-rt
no .config file found, moving on
[TIMER]{MRPROPER}: 0s
x86_64 architecture detected, copying config
'configs/kernel-rt-5.14.0-x86_64.config' -> '.config'
Setting Local Version for build
CONFIG_LOCALVERSION="-gvrose_ciqlts9_2-rt"
Making olddefconfig
  HOSTCC  scripts/basic/fixdep
  HOSTCC  scripts/kconfig/conf.o
  HOSTCC  scripts/kconfig/confdata.o
  HOSTCC  scripts/kconfig/expr.o
  LEX     scripts/kconfig/lexer.lex.c
  YACC    scripts/kconfig/parser.tab.[ch]
  HOSTCC  scripts/kconfig/lexer.lex.o
  HOSTCC  scripts/kconfig/menu.o
  HOSTCC  scripts/kconfig/parser.tab.o
  HOSTCC  scripts/kconfig/preprocess.o
  HOSTCC  scripts/kconfig/symbol.o
  HOSTCC  scripts/kconfig/util.o
  HOSTLD  scripts/kconfig/conf
#
# configuration written to .config
#
Starting Build
  SYSHDR  arch/x86/include/generated/uapi/asm/unistd_64.h
                                                                                                                  6,1           Top
`
The kABI check is skipped for RT kernels since up to this time there has not been a stable kernel ABI for RT kernels.

[SNIP]
`  SIGN    /lib/modules/5.14.0-gvrose_ciqlts9_2-rt+/kernel/sound/xen/snd_xen_front.ko
  INSTALL /lib/modules/5.14.0-gvrose_ciqlts9_2-rt+/kernel/virt/lib/irqbypass.ko
  STRIP   /lib/modules/5.14.0-gvrose_ciqlts9_2-rt+/kernel/virt/lib/irqbypass.ko
  SIGN    /lib/modules/5.14.0-gvrose_ciqlts9_2-rt+/kernel/virt/lib/irqbypass.ko
  DEPMOD  /lib/modules/5.14.0-gvrose_ciqlts9_2-rt+
[TIMER]{MODULES}: 147s
Making Install
sh ./arch/x86/boot/install.sh \
        5.14.0-gvrose_ciqlts9_2-rt+ arch/x86/boot/bzImage \
        System.map "/boot"
[TIMER]{INSTALL}: 34s
Checking kABI
kABI check skipped
Setting Default Kernel to /boot/vmlinuz-5.14.0-gvrose_ciqlts9_2-rt+ and Index to 0
Hopefully Grub2.0 took everything ... rebooting after time metrices
[TIMER]{MRPROPER}: 0s
[TIMER]{BUILD}: 4797s
[TIMER]{MODULES}: 147s
[TIMER]{INSTALL}: 34s
[TIMER]{TOTAL} 4998s
Rebooting in 10 seconds
Linux auto-kernel-test-92lts-rt 5.14.0-gvrose_ciqlts9_2-rt+ #1 SMP PREEMPT_RT Wed Feb 12 20:37:00 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

Full auto kernel test run commands and logs:
lts-9_2-rt-commands.log
lts-9_2-rt-build.log

Nothing remarkable about the kernel selftest logs.

…parse_format

jira VULN-9666
cve CVE-2024-53104
commit-author Benoit Sevens <bsevens@google.com>
commit ecf2b43

This can lead to out of bounds writes since frames of this type were not
taken into account when calculating the size of the frames buffer in
uvc_parse_streaming.

Fixes: c0efd23 ("V4L/DVB (8145a): USB Video Class driver")
	Signed-off-by: Benoit Sevens <bsevens@google.com>
	Cc: stable@vger.kernel.org
	Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
	Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
(cherry picked from commit ecf2b43)
	Signed-off-by: Greg Rose <g.v.rose@ciq.com>
Copy link
Collaborator

@bmastbergen bmastbergen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🥌

@PlaidCat
Copy link
Collaborator

Fixing PR description to make code blocks in comments you need to use 3 ```

\```
code goes here
\```

NOTE: \ is to make sure I can actually show what I'm trying to do they shouldn't be there.

Copy link
Collaborator

@PlaidCat PlaidCat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:shipit:

@gvrose8192 gvrose8192 merged commit 4c5f656 into ciqlts9_2-rt Feb 14, 2025
3 checks passed
@gvrose8192 gvrose8192 deleted the gvrose_ciqlts9_2-rt branch February 14, 2025 02:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

4 participants