{"id":4181,"url":"https://patchwork.libcamera.org/api/patches/4181/?format=json","web_url":"https://patchwork.libcamera.org/patch/4181/","project":{"id":1,"url":"https://patchwork.libcamera.org/api/projects/1/?format=json","name":"libcamera","link_name":"libcamera","list_id":"libcamera_core","list_email":"libcamera-devel@lists.libcamera.org","web_url":"","scm_url":"","webscm_url":""},"msgid":"<20200623190836.53446-8-paul.elder@ideasonboard.com>","date":"2020-06-23T19:08:21","name":"[libcamera-devel,v3,07/22] v4l2: v4l2_camera_proxy: Check for null arg values in main ioctl handler","commit_ref":null,"pull_url":null,"state":"superseded","archived":false,"hash":"a06c3d727e387b094dd2956aaeeea9ca5836429c","submitter":{"id":17,"url":"https://patchwork.libcamera.org/api/people/17/?format=json","name":"Paul Elder","email":"paul.elder@ideasonboard.com"},"delegate":null,"mbox":"https://patchwork.libcamera.org/patch/4181/mbox/","series":[{"id":1034,"url":"https://patchwork.libcamera.org/api/series/1034/?format=json","web_url":"https://patchwork.libcamera.org/project/libcamera/list/?series=1034","date":"2020-06-23T19:08:14","name":"Support v4l2-compliance","version":3,"mbox":"https://patchwork.libcamera.org/series/1034/mbox/"}],"comments":"https://patchwork.libcamera.org/api/patches/4181/comments/","check":"pending","checks":"https://patchwork.libcamera.org/api/patches/4181/checks/","tags":{},"headers":{"Return-Path":"","Received":["from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[213.167.242.64])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 7AFCF609A3\n\tfor ;\n\tTue, 23 Jun 2020 21:09:18 +0200 (CEST)","from jade.rasen.tech (unknown\n\t[IPv6:2400:4051:61:600:8147:f2a2:a8c6:9087])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id AD68B2A9;\n\tTue, 23 Jun 2020 21:09:16 +0200 (CEST)"],"Authentication-Results":"lancelot.ideasonboard.com; dkim=pass (1024-bit key; \n\tunprotected) header.d=ideasonboard.com\n\theader.i=@ideasonboard.com\n\theader.b=\"WlPdv04A\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1592939358;\n\tbh=DW18lGH6us0b+lJPl0hAf5Plp+HlTwzy38ePiSRZExQ=;\n\th=From:To:Cc:Subject:Date:In-Reply-To:References:From;\n\tb=WlPdv04AA9IJo3WYLEMuMjfxW9f1RwA+HYeEbksnQ40iF6nwnlXnP20Txq1KjNwer\n\tz+mvGzJtuEYTt1VP1kuSGXtM1CRln5OUTsqkgqorhdI67I/ESvFmfMcIN09j6HIXe0\n\tyA3gbOLJSQG45S9o7FI1RFuyMvFsZ1ZRf2sZ6JIw=","From":"Paul Elder ","To":"libcamera-devel@lists.libcamera.org","Date":"Wed, 24 Jun 2020 04:08:21 +0900","Message-Id":"<20200623190836.53446-8-paul.elder@ideasonboard.com>","X-Mailer":"git-send-email 2.27.0","In-Reply-To":"<20200623190836.53446-1-paul.elder@ideasonboard.com>","References":"<20200623190836.53446-1-paul.elder@ideasonboard.com>","MIME-Version":"1.0","Content-Transfer-Encoding":"8bit","Subject":"[libcamera-devel] [PATCH v3 07/22] v4l2: v4l2_camera_proxy: Check\n\tfor null arg values in main ioctl handler","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","X-List-Received-Date":"Tue, 23 Jun 2020 19:09:18 -0000"},"content":"The ioctl handlers currently don't check if arg is null, so if it ever\nis, it will cause a segfault. Check that arg is null and return -EFAULT\nin the main vidioc ioctl handler.\n\nSigned-off-by: Paul Elder \nReviewed-by: Laurent Pinchart \n\n---\nChanges in v3:\n- check ioctl rw flags for proper return value error\n- cosmetic changes\n\nChanges in v2:\n- moved !arg check to main ioctl handler, and added a set of supported\n ioctls\n- use !arg instead of arg == nullptr\n---\n src/v4l2/v4l2_camera_proxy.cpp | 30 ++++++++++++++++++++++++++++++\n src/v4l2/v4l2_camera_proxy.h | 3 +++\n 2 files changed, 33 insertions(+)","diff":"diff --git a/src/v4l2/v4l2_camera_proxy.cpp b/src/v4l2/v4l2_camera_proxy.cpp\nindex 7d750c0..b7d3644 100644\n--- a/src/v4l2/v4l2_camera_proxy.cpp\n+++ b/src/v4l2/v4l2_camera_proxy.cpp\n@@ -11,6 +11,7 @@\n #include \n #include \n #include \n+#include \n #include \n #include \n #include \n@@ -527,8 +528,37 @@ int V4L2CameraProxy::vidioc_streamoff(V4L2CameraFile *file, int *arg)\n \treturn ret;\n }\n \n+const std::set V4L2CameraProxy::supportedIoctls_ = {\n+\tVIDIOC_QUERYCAP,\n+\tVIDIOC_ENUM_FMT,\n+\tVIDIOC_G_FMT,\n+\tVIDIOC_S_FMT,\n+\tVIDIOC_TRY_FMT,\n+\tVIDIOC_REQBUFS,\n+\tVIDIOC_QUERYBUF,\n+\tVIDIOC_QBUF,\n+\tVIDIOC_DQBUF,\n+\tVIDIOC_STREAMON,\n+\tVIDIOC_STREAMOFF,\n+};\n+\n int V4L2CameraProxy::ioctl(V4L2CameraFile *file, unsigned long request, void *arg)\n {\n+\tif (!arg && (_IOC_DIR(request) & _IOC_WRITE)) {\n+\t\terrno = EFAULT;\n+\t\treturn -1;\n+\t}\n+\n+\tif (supportedIoctls_.find(request) == supportedIoctls_.end()) {\n+\t\terrno = ENOTTY;\n+\t\treturn -1;\n+\t}\n+\n+\tif (!arg && (_IOC_DIR(request) & _IOC_READ)) {\n+\t\terrno = EFAULT;\n+\t\treturn -1;\n+\t}\n+\n \tint ret;\n \tswitch (request) {\n \tcase VIDIOC_QUERYCAP:\ndiff --git a/src/v4l2/v4l2_camera_proxy.h b/src/v4l2/v4l2_camera_proxy.h\nindex 2be46e6..2582eb5 100644\n--- a/src/v4l2/v4l2_camera_proxy.h\n+++ b/src/v4l2/v4l2_camera_proxy.h\n@@ -11,6 +11,7 @@\n #include \n #include \n #include \n+#include \n #include \n #include \n #include \n@@ -68,6 +69,8 @@ private:\n \tstatic PixelFormat v4l2ToDrm(uint32_t format);\n \tstatic uint32_t drmToV4L2(const PixelFormat &format);\n \n+\tstatic const std::set supportedIoctls_;\n+\n \tunsigned int refcount_;\n \tunsigned int index_;\n \n","prefixes":["libcamera-devel","v3","07/22"]}