No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Vikash Garodia 1b86c1917e media: venus: hfi: add check to handle incorrect queue size
commit 69baf245b23e20efda0079238b27fc63ecf13de1 upstream.

qsize represents size of shared queued between driver and video
firmware. Firmware can modify this value to an invalid large value. In
such situation, empty_space will be bigger than the space actually
available. Since new_wr_idx is not checked, so the following code will
result in an OOB write.
...
qsize = qhdr->q_size

if (wr_idx >= rd_idx)
 empty_space = qsize - (wr_idx - rd_idx)
....
if (new_wr_idx < qsize) {
 memcpy(wr_ptr, packet, dwords << 2) --> OOB write

Add check to ensure qsize is within the allocated size while
reading and writing packets into the queue.

Cc: stable@vger.kernel.org
Fixes: d96d3f30c0 ("[media] media: venus: hfi: add Venus HFI files")
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Vikash Garodia <quic_vgarodia@quicinc.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-02 07:39:13 +02:00
arch x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine 2025-05-02 07:39:09 +02:00
block block: fix 'kmem_cache of name 'bio-108' already exists' 2025-04-10 14:29:37 +02:00
certs
crypto crypto: testmgr - some more fixes to RSA test vectors 2025-03-13 12:43:21 +01:00
Documentation sched/isolation: Prevent boot crash when the boot CPU is nohz_full 2025-04-10 14:29:35 +02:00
drivers media: venus: hfi: add check to handle incorrect queue size 2025-05-02 07:39:13 +02:00
fs ext4: don't treat fhandle lookup of ea_inode as FS corruption 2025-05-02 07:39:13 +02:00
include drm/amdkfd: clamp queue size to minimum 2025-05-02 07:39:12 +02:00
init initramfs: avoid filename buffer overrun 2024-12-14 19:44:21 +01:00
ipc
kernel tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER 2025-05-02 07:39:11 +02:00
lib lib: 842: Improve error handling in sw842_compress() 2025-04-10 14:29:40 +02:00
LICENSES
mm mm/page_alloc: fix uninitialized variable 2025-03-13 12:43:28 +01:00
net bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags 2025-05-02 07:39:13 +02:00
samples samples/bpf: Fix a resource leak 2024-12-14 19:44:50 +01:00
scripts selinux: Chain up tool resolving errors in install_policy.sh 2025-04-10 14:29:39 +02:00
security ima: Fix use-after-free on a dentry's dname.name 2025-03-13 12:43:19 +01:00
sound ALSA: usb-audio: Fix CME quirk for UF series keyboards 2025-05-02 07:39:10 +02:00
tools pm: cpupower: bench: Prevent NULL dereference on malloc failure 2025-05-02 07:39:09 +02:00
usr
virt KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status 2024-12-19 18:05:04 +01:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore Remove *.orig pattern from .gitignore 2024-11-08 16:20:33 +01:00
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.292 2025-04-10 14:29:43 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.