From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DA6D9391837 for ; Sat, 27 Jun 2026 10:01:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.49 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782554487; cv=none; b=q9OiijdNUe5aeunR3M45yNvIgqcHkc2PbU8NfBAlhw2xBO2dAdiAwGGw7m4w3Ac2pLwPus4C4lZ6x12U0lshgn4mXO3qxZS5zyfe3/Kgs9M1hrkwnn938k5QHb3DZMI7Kx0zUxDFSYPzByax9TB5Wy5D+yKY6CQ0JrACyF2zSq4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782554487; c=relaxed/simple; bh=vKQ0tFRaNgyCQPPW7FV5oOwk5g1uCMnAXYZmzILRviU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=gdyFRBFaOGhufp7IQpbrfoPjub64xJclN8jAAtwmGh3eYUp3SEMxeJT22ePcjgP960aZdR4dQxJan2rbFOomNBAUQUjV4ERU8DFJ2IlLgF6RryUPHyk83BmbkNEDsMDKHLo6n9E6vwFKrjKEYF51VRfLa4HGLuyzUWhRgB3HLo8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=0sec.ai; spf=pass smtp.mailfrom=0sec.ai; dkim=temperror (0-bit key) header.d=0sec.ai header.i=@0sec.ai header.b=mrE5+Fyq; arc=none smtp.client-ip=209.85.128.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=0sec.ai Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=0sec.ai Authentication-Results: smtp.subspace.kernel.org; dkim=temperror (0-bit key) header.d=0sec.ai header.i=@0sec.ai header.b="mrE5+Fyq" Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-492719b2d81so2147695e9.3 for ; Sat, 27 Jun 2026 03:01:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=0sec.ai; s=google; t=1782554483; x=1783159283; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=4Dv/Mm0JfcC4346InPEi7M99NfG9WPL/LtSaq5m0Xv8=; b=mrE5+FyqE69ERJl7dPzE8DP7lLc06qQPAO2iw6J/CpU50MH8ifRU9c6O/DwdsiGVfw ibiVeFdgznd6UOOepwzfotH+5k/EG8B5CFEVNBsa+UUqytqkpYp1efZYd13gys9m/fpF y8OlLi6G15wDvVuqinC9VW14y+7JkDdNExSelwOQpRcI4Eh/kodNCl/FO1J3fTfu9xBD QKvCJTYYGu2CKTdpKf3ECqrevhhRcHcjYtCuJWyscl3kPQ4YNpr9aIb7W07h8oe/GmoQ ehIZmFmqlONrjVPqChiVfoDUIg8+J6qCIrB8GL3rCO6aGGWE8Wh06ebfHHKuFBZoFJ1H AoUw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782554483; x=1783159283; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=4Dv/Mm0JfcC4346InPEi7M99NfG9WPL/LtSaq5m0Xv8=; b=E/Ja6cnxa7roDuPaDu9mmaIQqQkI4d8al4AOo4QHSOnI/YKEm+/7T78WfOpAI0zrkY IQDeFRBZl1lvURX3TE0mLZvk4wWl3iP1BwOt9CAF9JxSoQwhzsVZDEZlxZCPONzxJSLQ 3zczkbSKcOgaJpWw2E29fC45XccWijSgXlsyttuwa3SoRF7IsXnUIICZgd5htQda+R/w oDzO74KDjuzWiQzgla68BgxsyUTxUMTdQVdcK2BlOJIpVXHQWkDB/vdMJoWI015Qfw/Z Hdhq06tkehjpA0y41H3nR8XdfMmyslIEczjATHvH0ZeednN97V5f2OOL+wERW2GloID1 GlSQ== X-Forwarded-Encrypted: i=1; AFNElJ/owfzf0EIgDFUhzc+BiHSLBYraR4jZovbNiCtnFV5e1pkUk9dBopJl8rveRH7GgQwRECK1hIL4O5XfvqI=@vger.kernel.org X-Gm-Message-State: AOJu0Ywys1rKDG7TkK0wvurLYi8vLFe9h3mAR/gHEcS+B6wjw8x5WM0r ME/S/m1rYVDKO2Suafw2K6yVWAYZxnuTBXXEljNGaWQ68euLOdsi1MG7FDValMIPn8Cc X-Gm-Gg: AfdE7cmhHe+9+HFT/17v64SvXQjhJajaFMoXN8DlvqDx8+WFPLInrG70sjC4lTbfds/ OLfyxHfeDE/Mq9zDwhohBBw4uq3y0kNF+3hgZC362r9ApL45eaNm4R7KfuNlYMRyvY/DgdLsSHG XPjoKnez5cT99lHV4RUepfZUcuIIUZ11/tSDv3bzKikdeW6b58H2en40N1i4T302kpUaKpNW0By zMifGkSM06ZGn5XkM25VSRlnWfuxFdRaATGL0xMA1Rh7FRkGTT6JufpwwjJm/iLfwifa2lQuXk1 uN/ugneXcmuzmdD6EyLt10udkr1qZy5WCqAJshMEjQO848yzCgNdvkvIirjrvdCx53BAfvE5L07 Ur7TZUi2Rid6rk2xv+NWQZTFF07wWiHIPci8Fl7ftcrLQO/x5JyVd+fUlrnBnE7JJC7p7w2vIoZ TlX5mfTXvrM+D0ZapjlvHhL15ie1+X5WBal5kuzeYdgRXmjqYwB2mnB/f/U0sWPx50RqK5/Oi0x Mb8bEjNQ/8xoPvCFA0bgI5P/4/YATo4jiZCNDRTG9k6VA== X-Received: by 2002:a05:600c:4e8c:b0:492:425b:c773 with SMTP id 5b1f17b1804b1-4926fc3a548mr68637505e9.10.1782554483095; Sat, 27 Jun 2026 03:01:23 -0700 (PDT) Received: from PeakBook-Mini.tail8e484.ts.net ([178.197.218.209]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49271465f35sm69047735e9.9.2026.06.27.03.01.21 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Sat, 27 Jun 2026 03:01:22 -0700 (PDT) From: Doruk Tan Ozturk To: hansg@kernel.org, andy@kernel.org, mchehab@kernel.org, gregkh@linuxfoundation.org Cc: error27@gmail.com, sakari.ailus@linux.intel.com, linux-media@vger.kernel.org, linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org, Doruk Tan Ozturk Subject: [PATCH v3 1/2] media: atomisp: validate sizeimage against the allocated frame in framebuffer-to-CSS Date: Sat, 27 Jun 2026 12:01:18 +0200 Message-ID: <20260627100119.97650-2-doruk@0sec.ai> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260627100119.97650-1-doruk@0sec.ai> References: <20260627100119.97650-1-doruk@0sec.ai> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit atomisp_v4l2_framebuffer_to_css_frame() allocates the CSS frame from arg->fmt.{width,height,pixelformat}, but then copies and stores arg->fmt.sizeimage bytes into it. sizeimage is an independent, user-controlled v4l2_pix_format field, and nothing checks it against the allocated frame, so a sizeimage larger than width*height*bpp overflows res->data in hmm_store(). Reject a sizeimage that exceeds the allocated frame (res->data_bytes) before the copy/store. Note this ioctl path (S_ISP_FPN_TABLE) is currently gated off by 2b7eb2c5dc72 ("staging: media: atomisp: Disallow all private IOCTLs"), so it is not reachable from userspace today; this hardens the disabled-but-revivable path. Found by 0sec's autonomous vulnerability analysis (https://0sec.ai). Found by static analysis; not yet runtime-reproduced (Intel Baytrail/Cherrytrail ISP hardware required). Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2") Assisted-by: 0sec:claude-opus-4.8 Signed-off-by: Doruk Tan Ozturk --- drivers/staging/media/atomisp/pci/atomisp_cmd.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/staging/media/atomisp/pci/atomisp_cmd.c b/drivers/staging/media/atomisp/pci/atomisp_cmd.c index fec369575d88..04e7b2e03f34 100644 --- a/drivers/staging/media/atomisp/pci/atomisp_cmd.c +++ b/drivers/staging/media/atomisp/pci/atomisp_cmd.c @@ -3323,6 +3323,11 @@ atomisp_v4l2_framebuffer_to_css_frame(const struct v4l2_framebuffer *arg, goto err; } + if (arg->fmt.sizeimage > res->data_bytes) { + ret = -EINVAL; + goto err; + } + tmp_buf = vmalloc(arg->fmt.sizeimage); if (!tmp_buf) { ret = -ENOMEM; -- 2.53.0