In the Linux kernel, the following vulnerability has been resolved:
media: vivid: fix compose size exceed boundary
syzkaller found a bug:
BUG: unable to handle page fault for address: ffffc9000a3b1000 #PF: supervisor write access in kernel mode #PF: errorcode(0x0002) - not-present page PGD 100000067 P4D 100000067 PUD 10015f067 PMD 1121ca067 PTE 0 Oops: 0002 [#1] PREEMPT SMP CPU: 0 PID: 23489 Comm: vivid-000-vid-c Not tainted 6.1.0-rc1+ #512 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:memcpyerms+0x6/0x10 [...] Call Trace: <TASK> ? tpgfillplanebuffer+0x856/0x15b0 vividfillbuff+0x8ac/0x1110 vividthreadvidcaptick+0x361/0xc90 vividthreadvidcap+0x21a/0x3a0 kthread+0x143/0x180 retfrom_fork+0x1f/0x30 </TASK>
This is because we forget to check boundary after adjust compose->height int V4L2SELTGTCROP case. Add v4l2rectmapinside() to fix this problem for this case.
[
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f558c5208b0f70c8140e08ce09fcc84da48e789",
"id": "CVE-2022-48945-0076e80f",
"target": {
"file": "drivers/media/test-drivers/vivid/vivid-vid-cap.c",
"function": "vivid_vid_cap_s_selection"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 3670.0,
"function_hash": "104046052659091847401579026951583073109"
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c0ee15d9a102c732d0745566d254040085d5663",
"id": "CVE-2022-48945-1676e526",
"target": {
"file": "drivers/media/platform/vivid/vivid-vid-cap.c",
"function": "vivid_vid_cap_s_selection"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 3670.0,
"function_hash": "104046052659091847401579026951583073109"
}
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c0ee15d9a102c732d0745566d254040085d5663",
"id": "CVE-2022-48945-172cf8b0",
"target": {
"file": "drivers/media/platform/vivid/vivid-vid-cap.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"310597182065534741666178338526300903882",
"13958444562688027023168364052594864481",
"80631087490702578482415632149005954464",
"83253890379354376132192064620412373716"
]
}
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94a7ad9283464b75b12516c5512541d467cefcf8",
"id": "CVE-2022-48945-2128d1df",
"target": {
"file": "drivers/media/test-drivers/vivid/vivid-vid-cap.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"310597182065534741666178338526300903882",
"13958444562688027023168364052594864481",
"80631087490702578482415632149005954464",
"83253890379354376132192064620412373716"
]
}
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c7fba9503b826f0c061d136f8f0c9f953ed18b9",
"id": "CVE-2022-48945-29e3afcb",
"target": {
"file": "drivers/media/platform/vivid/vivid-vid-cap.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"310597182065534741666178338526300903882",
"13958444562688027023168364052594864481",
"80631087490702578482415632149005954464",
"83253890379354376132192064620412373716"
]
}
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab54081a2843aefb837812fac5488cc8f1696142",
"id": "CVE-2022-48945-3c0de802",
"target": {
"file": "drivers/media/test-drivers/vivid/vivid-vid-cap.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"310597182065534741666178338526300903882",
"13958444562688027023168364052594864481",
"80631087490702578482415632149005954464",
"83253890379354376132192064620412373716"
]
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5edc3604151919da8da0fb092b71d7dce07d848a",
"id": "CVE-2022-48945-53db2b7a",
"target": {
"file": "drivers/media/platform/vivid/vivid-vid-cap.c",
"function": "vivid_vid_cap_s_selection"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 3670.0,
"function_hash": "104046052659091847401579026951583073109"
}
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@54f259906039dbfe46c550011409fa16f72370f6",
"id": "CVE-2022-48945-5f9626e9",
"target": {
"file": "drivers/media/platform/vivid/vivid-vid-cap.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"310597182065534741666178338526300903882",
"13958444562688027023168364052594864481",
"80631087490702578482415632149005954464",
"83253890379354376132192064620412373716"
]
}
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f9d19f3a044ca651b0be52a4bf951ffe74259b9f",
"id": "CVE-2022-48945-761b2162",
"target": {
"file": "drivers/media/test-drivers/vivid/vivid-vid-cap.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"310597182065534741666178338526300903882",
"13958444562688027023168364052594864481",
"80631087490702578482415632149005954464",
"83253890379354376132192064620412373716"
]
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c7fba9503b826f0c061d136f8f0c9f953ed18b9",
"id": "CVE-2022-48945-78722077",
"target": {
"file": "drivers/media/platform/vivid/vivid-vid-cap.c",
"function": "vivid_vid_cap_s_selection"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 3670.0,
"function_hash": "104046052659091847401579026951583073109"
}
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5edc3604151919da8da0fb092b71d7dce07d848a",
"id": "CVE-2022-48945-90c1b7bd",
"target": {
"file": "drivers/media/platform/vivid/vivid-vid-cap.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"310597182065534741666178338526300903882",
"13958444562688027023168364052594864481",
"80631087490702578482415632149005954464",
"83253890379354376132192064620412373716"
]
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94a7ad9283464b75b12516c5512541d467cefcf8",
"id": "CVE-2022-48945-b432d60f",
"target": {
"file": "drivers/media/test-drivers/vivid/vivid-vid-cap.c",
"function": "vivid_vid_cap_s_selection"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 3670.0,
"function_hash": "104046052659091847401579026951583073109"
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ccb5392c4fea0e7d9f7ab35567e839d74cb3998b",
"id": "CVE-2022-48945-b7323d29",
"target": {
"file": "drivers/media/test-drivers/vivid/vivid-vid-cap.c",
"function": "vivid_vid_cap_s_selection"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 3670.0,
"function_hash": "104046052659091847401579026951583073109"
}
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ccb5392c4fea0e7d9f7ab35567e839d74cb3998b",
"id": "CVE-2022-48945-c75f019f",
"target": {
"file": "drivers/media/test-drivers/vivid/vivid-vid-cap.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"310597182065534741666178338526300903882",
"13958444562688027023168364052594864481",
"80631087490702578482415632149005954464",
"83253890379354376132192064620412373716"
]
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@54f259906039dbfe46c550011409fa16f72370f6",
"id": "CVE-2022-48945-c7a25bd6",
"target": {
"file": "drivers/media/platform/vivid/vivid-vid-cap.c",
"function": "vivid_vid_cap_s_selection"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 3670.0,
"function_hash": "104046052659091847401579026951583073109"
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f9d19f3a044ca651b0be52a4bf951ffe74259b9f",
"id": "CVE-2022-48945-cec3a47f",
"target": {
"file": "drivers/media/test-drivers/vivid/vivid-vid-cap.c",
"function": "vivid_vid_cap_s_selection"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 3670.0,
"function_hash": "104046052659091847401579026951583073109"
}
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f558c5208b0f70c8140e08ce09fcc84da48e789",
"id": "CVE-2022-48945-db12f226",
"target": {
"file": "drivers/media/test-drivers/vivid/vivid-vid-cap.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"310597182065534741666178338526300903882",
"13958444562688027023168364052594864481",
"80631087490702578482415632149005954464",
"83253890379354376132192064620412373716"
]
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab54081a2843aefb837812fac5488cc8f1696142",
"id": "CVE-2022-48945-ecf341b6",
"target": {
"file": "drivers/media/test-drivers/vivid/vivid-vid-cap.c",
"function": "vivid_vid_cap_s_selection"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 3670.0,
"function_hash": "104046052659091847401579026951583073109"
}
}
]