5.4-stable patches

added patches:
	media-dvb_vb2-fix-possible-out-of-bound-access.patch

diff --git a/queue-5.4/media-dvb_vb2-fix-possible-out-of-bound-access.patch b/queue-5.4/media-dvb_vb2-fix-possible-out-of-bound-access.patch
new file mode 100644 (file)
index 0000000..da3da5b
--- /dev/null
+++ b/queue-5.4/media-dvb_vb2-fix-possible-out-of-bound-access.patch
@@ -0,0 +1,53 @@
+From 37238699073e7e93f05517e529661151173cd458 Mon Sep 17 00:00:00 2001
+From: Hangyu Hua <hbh25y@gmail.com>
+Date: Thu, 19 May 2022 03:17:43 +0100
+Subject: media: dvb_vb2: fix possible out of bound access
+
+From: Hangyu Hua <hbh25y@gmail.com>
+
+commit 37238699073e7e93f05517e529661151173cd458 upstream.
+
+vb2_core_qbuf and vb2_core_querybuf don't check the range of b->index
+controlled by the user.
+
+Fix this by adding range checking code before using them.
+
+Fixes: 57868acc369a ("media: videobuf2: Add new uAPI for DVB streaming I/O")
+Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
+Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/dvb-core/dvb_vb2.c |   11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/media/dvb-core/dvb_vb2.c
++++ b/drivers/media/dvb-core/dvb_vb2.c
+@@ -358,6 +358,12 @@ int dvb_vb2_reqbufs(struct dvb_vb2_ctx *
+ 
+ int dvb_vb2_querybuf(struct dvb_vb2_ctx *ctx, struct dmx_buffer *b)
+ {
++      struct vb2_queue *q = &ctx->vb_q;
++
++      if (b->index >= q->num_buffers) {
++              dprintk(1, "[%s] buffer index out of range\n", ctx->name);
++              return -EINVAL;
++      }
+       vb2_core_querybuf(&ctx->vb_q, b->index, b);
+       dprintk(3, "[%s] index=%d\n", ctx->name, b->index);
+       return 0;
+@@ -382,8 +388,13 @@ int dvb_vb2_expbuf(struct dvb_vb2_ctx *c
+ 
+ int dvb_vb2_qbuf(struct dvb_vb2_ctx *ctx, struct dmx_buffer *b)
+ {
++      struct vb2_queue *q = &ctx->vb_q;
+       int ret;
+ 
++      if (b->index >= q->num_buffers) {
++              dprintk(1, "[%s] buffer index out of range\n", ctx->name);
++              return -EINVAL;
++      }
+       ret = vb2_core_qbuf(&ctx->vb_q, b->index, b, NULL);
+       if (ret) {
+               dprintk(1, "[%s] index=%d errno=%d\n", ctx->name,

diff --git a/queue-5.4/series b/queue-5.4/series
index 54631d4a4dae7b783463e30b0f64425df0519ce4..bc20d4d6d175eed2d49776ba5bb62827c76d8db7 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -12,3 +12,4 @@ mm-page_alloc-fix-race-condition-between-build_all_zonelists-and-page-allocation
 mm-prevent-page_frag_alloc-from-corrupting-the-memory.patch
 mm-migrate_device.c-flush-tlb-while-holding-ptl.patch
 mm-fix-madivse_pageout-mishandling-on-non-lru-page.patch
+media-dvb_vb2-fix-possible-out-of-bound-access.patch