From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CE50C24E4C6 for ; Sat, 15 Aug 2026 19:38:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.41 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786822727; cv=none; b=mG3lFEwhP52k3EDvzmPWUNQLoEfkPDlSrrpArCJMqDbuLfAC3WBzSEv2MCNj2mMQpkHCbLjov5dXI8QFpbxN/Hn0rphmYZzDBnJB50boXOgDPuIdHMQEjXfnCVGXe+mWB9fIf/G6WCQDOTnWjAg6uRPbG4+TuGtlkX8awx+3NmI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786822727; c=relaxed/simple; bh=m2/jhBAYg2/LawuSqK1sjJNSGD3aaB4RYTaRo3ybk8s=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=e0mKP+U8Jx+KW9sd30DlyR2ozPJXrJmwwMrSCgLvShtbRgZGfjCRUjJMdCr+66v9Za1LvUgkv43/s6HzV6dNdrc8rkfRfO2bYzxWxYWMhJTZKkIn2Yy48IO2fviVSNReolA3IoID63eLv0/MePCfr3Y6si888k0fynzBIPrRGa8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=quwHRhxl; arc=none smtp.client-ip=209.85.128.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="quwHRhxl" Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-49978908b35so17199415e9.0 for ; Sat, 15 Aug 2026 12:38:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786822723; x=1787427523; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=eaUiQBv7IUsoP0lKzTE6/BdETxQ+RizUmTEW5rmY3XY=; b=quwHRhxlUpi5qslJfGtJAe4Ssdgl5NSWHCGzufE/bLT56vPK1UqDJtsQiOxEdKcATy uUIXLFgyet7FAI2edZaWDdGJZAb38fkHnATCcMHylxHsEOJRSamcteEmvRuXGLqhaJqh 7Jnis00azx7zoiCFFN7o1NfgSZ8oM6WVGf2dtbwF6WlObeTJ2EHSobmiDSaIsut/5fbx 8uo7WQez9XT6gX/SUYs8zLxl19hsSi87c39SgVnTfcQMTVebvESuH5KaQZjcSitn+K2d gBDpuXSjyby87b7wnCo4vsme/CcgXi3+w/IEijFuLUBR8chlJn2fq0R/lWh1YfesBK3D 8JfQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786822723; x=1787427523; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=eaUiQBv7IUsoP0lKzTE6/BdETxQ+RizUmTEW5rmY3XY=; b=qLtTiV8ufLWR/7xZbOVLjxdlN+TLNSX7IvcN6qVW6GXsCZqf485ufVinxqrj7kWY1C tR9VvqiRZeZXBhxvjRJFKcrKKOctGGqwVZAwDBDNoO+yYaJJYCSWV85i4olAa9NZvlG+ kdXZ5on2Y1f7x91//l0ZMJc6+73/oOAJONht/Kq/fe5duGOZfqIOYlwfz0Jf0JlqUrOh anHhTsX5jM8O0/O3IuCGd+qZdSIbBYqqmRR+CLceAIEtdumfGhTCtK9LVVERSkBJ/941 crm2a3hArsD7ONjXdnY6QWfJWsvihqH21l9kL7AVlQDMK+UivCjVxVCi6S/xAKTvgOfP mb5w== X-Forwarded-Encrypted: i=1; AHgh+RqtakRspzMCxOhfJAGy+js6mcwxHYwDHphMEYgdIOQoBKqmI1V+dYV0u3MOkFmEUtuECULg6ZKocAF2WiU=@vger.kernel.org X-Gm-Message-State: AOJu0Yzvjdb/hNuIOll5b1mPwk5Y+TxMEcyk4CDxoxwXyqTq9f0QvRO7 uL12y5ImjUtEEnEQ8qsGrnv08pQx7Llq44vTQyLAN0wdZzpWctyNXDKW X-Gm-Gg: AR+sD11piznDjcWtaf7PWHSGvVEQ04buqR7vyyTVjDU+BSVd8KzYeWQnK77clutY9zH KTloL1F3/Nv1ziKs1QZnYtgoRNUPvoqG5BjhJONPoofIlHOwp6a+2KkSNOVsQ2ARYYg/Jxz6znd 3MlRoC7K4Y9gbmaA92HjPP9hXnliYOCqBDDYLkzO++4vqQirk939v+qG4Zwq9pNEhSOZiy5iKUF YIBQHFUyMDbgFss7eCrYt0qeSfnIyCMEZECCkl2D0zItbk1fcFOIrnZn9YHlK5KyrKYDDL0Z/3e w00v87+NrL0XbUEc9xG+R/+Vx6IEASS6YPJQpN/So1psEZad8xH+7U6ouh1oetI/YjAi/vcKXN7 wLRfB5hdhDuPT0/Tl1QH0us0ZvyivAVIoosSsRtZDocJONkp23m7tCJ3adqZBrx3FhRbS3VUJBU fJBEjH9MitJYoYFMw9jo0eJV/v6XMPzj/cKORcm9Obqjk7SElGMULJLJ7nyJjTyFTFlAvdGZHQp ZPKQ/2n8Jk4gorvQlo8/c0DSI53rp+fy4Num1AEyqOSnnrl X-Received: by 2002:a7b:c5ce:0:b0:499:726c:d658 with SMTP id 5b1f17b1804b1-499879bb9e5mr156201405e9.19.1786822722856; Sat, 15 Aug 2026 12:38:42 -0700 (PDT) Received: from dohko.chello.ie (188-141-5-72.dynamic.upc.ie. [188.141.5.72]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-4815f15b946sm19640500f8f.0.2026.08.15.12.38.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 15 Aug 2026 12:38:42 -0700 (PDT) From: David Carlier To: Jacopo Mondi , Mauro Carvalho Chehab , Michael Riesch , Daniel Scally , Laurent Pinchart , Hans Verkuil Cc: David Carlier , stable@vger.kernel.org, Sakari Ailus , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] media: v4l2-isp: reject zero-sized parameter blocks Date: Sat, 15 Aug 2026 20:38:39 +0100 Message-ID: <20260815193839.141406-1-devnexen@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit v4l2_isp_params_validate_buffer() advances by block->size but never bounds it from below. A block with size 0 passes both the block->size > buffer_size test and the comparison against info->size whenever the driver's type_info[] entry is an uninitialised hole, so the walk makes no forward progress and loops forever. Drivers call this from vb2 .buf_prepare, so VIDIOC_QBUF on the parameters video device hangs the calling task with the queue mutex held. rppx1 has such a hole today; fix the core so the walk terminates for any driver. Require every block to be at least as large as its header. Blocks carrying only a header to disable a block are exactly that size and still pass. Fixes: 3cb6de6fafb8 ("media: v4l2-core: Introduce v4l2-isp.c") Cc: stable@vger.kernel.org Signed-off-by: David Carlier --- drivers/media/v4l2-core/v4l2-isp.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/media/v4l2-core/v4l2-isp.c b/drivers/media/v4l2-core/v4l2-isp.c index 1eb46e080afa..760e16a5ba9d 100644 --- a/drivers/media/v4l2-core/v4l2-isp.c +++ b/drivers/media/v4l2-core/v4l2-isp.c @@ -84,6 +84,13 @@ int v4l2_isp_params_validate_buffer(struct device *dev, struct vb2_buffer *vb, return -EINVAL; } + if (block->size < sizeof(*block)) { + dev_dbg(dev, + "Invalid block size %u at offset %zu\n", + block->size, block_offset); + return -EINVAL; + } + if (block->size > buffer_size) { dev_dbg(dev, "Premature end of parameters data\n"); return -EINVAL; -- 2.55.0