Received: by 2002:a05:6a10:9848:0:0:0:0 with SMTP id x8csp59353pxf; Tue, 9 Mar 2021 23:49:21 -0800 (PST) X-Google-Smtp-Source: ABdhPJw0oVc6uz6H/s1ZpCXAJzAJ3E3nwII0oSgP6xw02mjsiL6DYmlJN7ibTxNxDY4uRASw0yDS X-Received: by 2002:a17:907:d8a:: with SMTP id go10mr2344500ejc.46.1615362560907; Tue, 09 Mar 2021 23:49:20 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1615362560; cv=none; d=google.com; s=arc-20160816; b=JIFoJ+pSbvGxNtZsFrpdDiF+iuI5SJbV+KEeAGz7tHsJokE9hIIFUFjlsFt5d67OPX gdnyGy/uUyx6mzrl0/13p44fqbTa37g3EN0DxsTvlTrQ81bDG+WYDqECb5faRc7zByE/ +OFn0Swopu1e3DhxoYfzPFG8FNwnzvkDqd7JyUAmO/A2Ge6QYHJDvWxETlJVtshHEVM6 WImU9S3TrcNVpiJisOogRfxVic6bhJot6uUVhTtuVgx1nMpi27CI5wZmbxmynYFlmGbO B4EgK9Q943tPCa5azMvy+2W2QFBfDXRcy2/Or57qdWHNDE9EumEgUqo2z//0/yNaUuqD eDPg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:in-reply-to:content-disposition:mime-version :references:message-id:subject:cc:to:from:date:dkim-signature; bh=utFuLZK1zPSYLVkQnM9VsZ3uv6ifJQqotmj3ZtAm8fs=; b=xBLrzFs9WZN9HbI2prDD+qNdHZOWfIDaui5qsWKjo44XjPyPotyIIP1mzMahVoRQ6L rtPFhGURLd90ah2UPpg/ODJ+PVaxEL/0Q/IFZF3QeYac/krESRpLRD452pxJNeLHSz6B g1CT6JHb/UdyEVL3KmsWCM1BscGGUMcXYfu3RfFGE2ffv5pOV/M8s3ws+8id1FEs/eiG X4P3ohFySjG+0D/qYlWFUvMx1t43Cj8N2P3O+RnqyenV4AUw+pjv1Z8K4Nvsnb+qOXUz VftgIUdLtAdrIbTkTXlIuJtCUUVszlQFL0cdCVGF+72h9n0nNcFSKuRMxZN6GUNn6V2o 44XA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=GkhE+mK9; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id gx21si10571477ejc.503.2021.03.09.23.48.58; Tue, 09 Mar 2021 23:49:20 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=GkhE+mK9; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229544AbhCJHr7 (ORCPT + 99 others); Wed, 10 Mar 2021 02:47:59 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57078 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232030AbhCJHrg (ORCPT ); Wed, 10 Mar 2021 02:47:36 -0500 Received: from mail-pg1-x52d.google.com (mail-pg1-x52d.google.com [IPv6:2607:f8b0:4864:20::52d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BDBACC06174A; Tue, 9 Mar 2021 23:47:36 -0800 (PST) Received: by mail-pg1-x52d.google.com with SMTP id l2so10850660pgb.1; Tue, 09 Mar 2021 23:47:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=utFuLZK1zPSYLVkQnM9VsZ3uv6ifJQqotmj3ZtAm8fs=; b=GkhE+mK9KYnV09Je9GdKGBCeef4kZim6uOf8AFPMHyqHdmXdtodvDqrZ9iYrhLgWeV ay9KsAEZXpCWf5MwnWaMUQU79OrVZcX2Au2qkCFpSQNGYw7X1Js4zHH3DRgp8mTV4hdB VEMkGwgSEz0VE+pJNY02aje8UT3rhv/Pt/bLIJWw/vDtqM3me0aeeS1O/pNw+iuE5D3t N1Z+V1E+/+/9LPdGlRsPXa8scrlGr/36LTDniOEGWClM4tJ4zgka/38F/5cqa3CQGEvx eQ+Qt+Udn+Pe2BXk9Nc2SE1Qjrklq6mZRHteI7bpCYzWDSPuMeoqtfN1r44cKslE31xM ykfQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=utFuLZK1zPSYLVkQnM9VsZ3uv6ifJQqotmj3ZtAm8fs=; b=lr+ycrwwEC4wl79Xwde3TN+Mj+Rd5s3/c3P2hOE1B+epVFbRMmI9H74FbroBxNdHP4 lQhbmGdWBzdDpvUxVe7OeQoA8FAlQdqeGzZTVz11wvLPFOz9Y6kLqq665YHxwibBbmWW jn8YXVvctSJ3zGWAFCXV+zTijyQ622cnVT27Cs0xi7rSs2ibSzGXfhkGt9/TwIuZYkRi KCWlJ+UQA+6ygg/AxN7Xay/cdGw3lRMKijMn1fmZV1slqv+cCsoYeVBtGLb4rRW9w8V/ qbb9Ju4DSV05DKmfrbbUQRc5B8eg4+NrNppmT73ED4fkluCD/BwublehqygKmVPkMP0f NCgw== X-Gm-Message-State: AOAM533dSUjCM89BE75ph7+k4wr198Jli9m4o0vAqX20kde++Vr4CZiW EQrYw4vW2hKyjO6Nxm5Qoac= X-Received: by 2002:a63:d842:: with SMTP id k2mr1694746pgj.428.1615362456288; Tue, 09 Mar 2021 23:47:36 -0800 (PST) Received: from google.com ([2409:10:2e40:5100:30c3:e7ed:8b0a:7f01]) by smtp.gmail.com with ESMTPSA id k128sm15004701pfd.137.2021.03.09.23.47.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 09 Mar 2021 23:47:35 -0800 (PST) Date: Wed, 10 Mar 2021 16:47:30 +0900 From: Sergey Senozhatsky To: Ricardo Ribalda Cc: Tomasz Figa , Marek Szyprowski , Mauro Carvalho Chehab , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Laurent Pinchart , stable@vger.kernel.org Subject: Re: [PATCH] media: videobuf2: Fix integer overrun in allocation Message-ID: References: <20210309234317.1021588-1-ribalda@chromium.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20210309234317.1021588-1-ribalda@chromium.org> Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On (21/03/10 00:43), Ricardo Ribalda wrote: > > The plane_length is an unsigned integer. So, if we have a size of > 0xffffffff bytes we incorrectly allocate 0 bytes instead of 1 << 32. > > Cc: stable@vger.kernel.org > Fixes: 7f8414594e47 ("[media] media: videobuf2: fix the length check for mmap") > Signed-off-by: Ricardo Ribalda Reviewed-by: Sergey Senozhatsky