github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-08-08 08:26:18 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
ee4cf79820
linux/drivers
History
Kees Cook ee4cf79820 staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() 
When gmin_get_config_var() calls efi.get_variable() and the EFI variable
is larger than the expected buffer size, two behaviors combine to create
a stack buffer overflow:

1. gmin_get_config_var() does not return the proper error code when
   efi.get_variable() fails. It returns the stale 'ret' value from
   earlier operations instead of indicating the EFI failure.

2. When efi.get_variable() returns EFI_BUFFER_TOO_SMALL, it updates
   *out_len to the required buffer size but writes no data to the output
   buffer. However, due to bug #1, gmin_get_var_int() believes the call
   succeeded.

The caller gmin_get_var_int() then performs:
- Allocates val[CFG_VAR_NAME_MAX + 1] (65 bytes) on stack
- Calls gmin_get_config_var(dev, is_gmin, var, val, &len) with len=64
- If EFI variable is >64 bytes, efi.get_variable() sets len=required_size
- Due to bug #1, thinks call succeeded with len=required_size
- Executes val[len] = 0, writing past end of 65-byte stack buffer

This creates a stack buffer overflow when EFI variables are larger than
64 bytes. Since EFI variables can be controlled by firmware or system
configuration, this could potentially be exploited for code execution.

Fix the bug by returning proper error codes from gmin_get_config_var()
based on EFI status instead of stale 'ret' value.

The gmin_get_var_int() function is called during device initialization
for camera sensor configuration on Intel Bay Trail and Cherry Trail
platforms using the atomisp camera stack.

Reported-by: zepta <z3ptaa@gmail.com>
Closes: https://lore.kernel.org/all/CAPBS6KoQyM7FMdPwOuXteXsOe44X4H3F8Fw+y_qWq6E+OdmxQA@mail.gmail.com
Fixes: 38d4f74bc1 ("media: atomisp_gmin_platform: stop abusing efivar API")
Reviewed-by: Hans de Goede <hansg@kernel.org>
Link: https://lore.kernel.org/r/20250724080756.work.741-kees@kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>
2025-07-28 17:48:41 -07:00
..
accel accel/amdxdna: Fix incorrect PSP firmware size 2025-06-09 07:16:32 -07:00
accessibility
acpi acpi: nfit: intel: avoid multiple -Wflex-array-member-not-at-end warnings 2025-06-27 13:27:23 -07:00
amba
android Char/Misc/IIO pull request for 6.16-rc1 2025-06-06 11:50:47 -07:00
ata treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
atm treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
auxdisplay treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
base driver core: faux: Quiet probe failures 2025-06-10 19:23:25 +02:00
bcma
block block-6.16-20250614 2025-06-14 09:25:22 -07:00
bluetooth Including fixes from bluetooth and wireless. 2025-06-12 09:50:36 -07:00
bus treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
cache
cdrom
cdx
char treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
clk I've recently moved computers (among other things) so I'm sending this from a 2025-05-30 09:15:40 -07:00
clocksource arm: Handle KCOV __init vs inline mismatches 2025-07-21 21:43:39 -07:00
comedi treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
connector
counter Second set of Counter updates for 6.16 2025-05-24 08:29:32 +02:00
cpufreq rust: Use CpuId in place of raw CPU numbers 2025-06-12 10:31:28 +05:30
cpuidle Merge branch 'pm-cpuidle' 2025-05-30 20:21:36 +02:00
crypto treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
cxl Merge branch 'for-6.16/cxl-features-ras' into cxl-for-next 2025-05-23 13:26:24 -07:00
dax
dca
devfreq
dio
dma treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
dma-buf udmabuf: use sgtable-based scatterlist wrappers 2025-06-11 13:18:07 +02:00
dpll
edac CXL changes for v6.16 2025-06-03 13:24:14 -07:00
eisa
extcon
firewire treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
firmware stackleak: Rename STACKLEAK to KSTACK_ERASE 2025-07-21 21:35:01 -07:00
fpga
fsi
fwctl
gnss
gpio gpio updates for v6.16-rc1 2025-05-27 15:22:01 -07:00
gpu Merge tag 'drm-misc-fixes-2025-06-12' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes 2025-06-13 14:57:09 +10:00
greybus treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
hid treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
hsi treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
hte
hv hyperv-next for v6.16 2025-06-03 08:39:20 -07:00
hwmon treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
hwspinlock
hwtracing coresight: updates for Linux v6.16 2025-05-22 18:04:43 +02:00
i2c treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
i3c i3c: controllers do not need to depend on I3C 2025-05-24 22:49:07 +02:00
idle intel_idle: Update arguments of mwait_idle_with_hints() 2025-06-10 21:09:28 +02:00
iio treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
infiniband treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
input treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
interconnect
iommu iommu/tegra: Fix incorrect size calculation 2025-06-13 17:02:31 +02:00
ipack
irqchip dmaengine updates for v6.16 2025-06-05 08:49:30 -07:00
isdn treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
leds treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
macintosh
mailbox treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
mcb
md treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
media treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
memory treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
memstick treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
message
mfd MFD for v6.16 2025-06-03 11:53:55 -07:00
misc stackleak: Rename STACKLEAK to KSTACK_ERASE 2025-07-21 21:35:01 -07:00
mmc treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
most treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
mtd treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
mux mux: Convert mux_control_ops to a flex array member in mux_chip 2025-06-18 14:20:32 -07:00
net Including fixes from bluetooth and wireless. 2025-06-12 09:50:36 -07:00
nfc treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
ntb
nubus
nvdimm
nvme block-6.16-20250614 2025-06-14 09:25:22 -07:00
nvmem Char/Misc/IIO pull request for 6.16-rc1 2025-06-06 11:50:47 -07:00
of - The 11 patch series "Add folio_mk_pte()" from Matthew Wilcox 2025-05-31 15:44:16 -07:00
opp
parisc
parport treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
pci The delayed from_timer() API cleanup: 2025-06-08 11:33:00 -07:00
pcmcia treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
peci
perf arm64 updates for 6.16 2025-05-28 14:55:35 -07:00
phy phy-for-6.16 2025-06-05 08:20:21 -07:00
pinctrl pinctrl: sunxi: dt: Consider pin base when calculating bank number from pin 2025-06-10 14:35:40 +02:00
platform treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
pmdomain
pnp
power - The 3 patch series "hung_task: extend blocking task stacktrace dump to 2025-05-31 19:12:53 -07:00
powercap
pps treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
ps3
ptp Including fixes from bluetooth and wireless. 2025-06-12 09:50:36 -07:00
pwm pwm: axi-pwmgen: Fix handling of external clock 2025-06-06 13:16:50 -07:00
rapidio drivers/rapidio/rio_cm.c: prevent possible heap overwrite 2025-06-11 22:42:36 -07:00
ras
regulator regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt() 2025-06-08 23:29:48 +01:00
remoteproc remoteproc updates for v6.16 2025-06-02 11:04:29 -07:00
reset
rpmsg
rtc treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
s390 Merge branch '6.16/scsi-queue' into 6.16/scsi-fixes 2025-06-09 15:34:06 -04:00
sbus
scsi scsi: error: alua: I/O errors for ALUA state transitions 2025-06-09 22:02:13 -04:00
sh
siox
slimbus
soc arm: Handle KCOV __init vs inline mismatches 2025-07-21 21:43:39 -07:00
soundwire soundwire updates for 6.16 2025-06-05 08:07:24 -07:00
spi spi: spi-pci1xxxx: Drop MSI-X usage as unsupported by DMA engine 2025-06-13 12:25:31 +01:00
spmi
ssb
staging staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() 2025-07-28 17:48:41 -07:00
target treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
tc
tee
thermal Thermal control updates for 6.16-rc1 2025-05-27 16:28:02 -07:00
thunderbolt
tty treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
ufs Merge branch '6.16/scsi-queue' into 6.16/scsi-fixes 2025-06-09 15:34:06 -04:00
uio Char/Misc/IIO pull request for 6.16-rc1 2025-06-06 11:50:47 -07:00
usb treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
vdpa vdpa/octeon_ep: Control PCI dev enabling manually 2025-05-27 10:27:53 -04:00
vfio pci-v6.16-changes 2025-06-04 11:26:17 -07:00
vhost virtio, vhost: features, fixes 2025-05-29 08:15:35 -07:00
video treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
virt treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
virtio virtio_rtc: Add RTC class driver 2025-05-27 10:27:54 -04:00
w1 Char/Misc/IIO pull request for 6.16-rc1 2025-06-06 11:50:47 -07:00
watchdog treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
xen xen/x86: fix initial memory balloon target 2025-05-23 07:09:00 +02:00
zorro
Kconfig
Makefile