From nobody Tue Sep 29 01:19:49 2026 Received: from mail-lf1-f47.google.com (mail-lf1-f47.google.com [209.85.167.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5994C42CB00 for ; Thu, 13 Aug 2026 20:43:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.47 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786653814; cv=none; b=BtR00vqRwTGZaVChoFLDiUKl+39t36jN+4Pgv4pVXv9UPupg8Xln9+Cw0UZ1m5RkRmB4odPuYbDGQ9FlxRLWdMQTq52+GDf0Ryk/KjVnqqkZxp2X3eKNuVyphT1+3HcVyDhefZyyHg6t31XUMWyI4Bg+CeGITRSjb6w6Pj11S5I= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786653814; c=relaxed/simple; bh=UsjfjuhDncxtlbBeZ9IQfuCMw8Vym1bwPGtUunGcIJs=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=Uq+bBI1/fzreUIouM3IBthUyIJ2sQmim+iY+l1vwalMi4NTlQZuXE44dEk1HIVZudrxlk6GXnaHbWpqeqeNbfJScImzfFo6b4DD/fv4s7fr9qyQ248GwulGMI1Pp66XlCFrA7o5ldLUpU/2I2BIiW9Rdyp4FLpLPCKzBgdKs+Vk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=chromium.org; spf=pass smtp.mailfrom=chromium.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b=YKQvpvxt; arc=none smtp.client-ip=209.85.167.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=chromium.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=chromium.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="YKQvpvxt" Received: by mail-lf1-f47.google.com with SMTP id 2adb3069b0e04-5aeb59d54b1so246148e87.1 for ; Thu, 13 Aug 2026 13:43:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1786653810; x=1787258610; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=NdrNrxezjoizxu3zjSdvwdOKcGeoA1YtD7Hl3JvJCrU=; b=YKQvpvxte2Lew8DZ5sPh1icol+ABX16MA5EOORUVWK4C7FuNirUn+TXmrUu1S+LRFc P16rNgww0MGV78SwInO63gz6pEwX93quSQe0LXvu6D6c0MP4OpKagaUlXOMeyDJGGM4X 7V24FElM6FnXWogF587dCLc/+kNLqVUhCDwj0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786653810; x=1787258610; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=NdrNrxezjoizxu3zjSdvwdOKcGeoA1YtD7Hl3JvJCrU=; b=km3V0IcyiMW7S0sxuSCOGs7COdQwH3/tNwOybZD6/xWUYwpOERH1c58VWj669/1HH1 HD/hcZ4KDcCcbEjsU61nyi01/AQmEpzMh/Vywom+CUqFyHW0NJ3h6y0acOZ6ExFCxOeq CKjQ7gZPbDiyOn+Sh1W/88LcDfUWH6n/6pmvpZfRUFXCM9oAsF2YOs807eg9FxFsNDyg Fsis56lIvL/rK69N4ms8fmyVJCb19nXRleNwfn4Z1/HsFupfzbx2Ct1PoR/6mM98SaAw J2e6AQfNNhKGqLd/QIp1w3J7gZDQ1hgzjc+iUxcaM5l9sJPVXIhdVvntlT+CBMtenTfk EIwA== X-Forwarded-Encrypted: i=1; AHgh+RpwvvrIZ6LYZmqRfdEfKp+wSEWZz2MQJgqaz9QZvOkFfLucFmBT8L3P9mFKb+D/+tnRh58RF1z6uMCKIHA=@vger.kernel.org X-Gm-Message-State: AOJu0Yz0tYT1SS68d6GEJ3hlt1w0qcDDrQxJfhxc5dtYhiz24rzMMgYQ 7c2ejoQ6GjOOYKTIDevHuQ9aHAKGOBZN1ci9MP0/iPpLXMDvAMXu4wH9grLXwjz8C+DqkCk2Uq2 ZmiiZeQ== X-Gm-Gg: AR+sD11wwPfe1uCBjESPMjEdyGkMPda2ip+LSUKcwoiu4DaL7wMR6bwtfqZd6/43qst uRCN9fyXUU4bQbhIimSI+2XAFCUF81pEY2hkJoDSlrc8d8ujeR/azJ+26A7A2pVapO227yZrUkI a6fd2VgbthJujQ7YyXu43l9Xi03yLMHg4SOzzDjy0WXLOxNVHZD0a6nK83yAJGar0sHclL+jfQm 7MPN77QN7UhdZbUZj6kN5jq36qX8I9IdlCsQeXk54Fgu2uxXLovwfhGk7uJwJ7pVw9zj8aB8XaT /HctWds2M8h4UvlZOAwUq7Ft/6HFTl5+XU3YAiXp+DHW1KZbPkpm6RJI69YNl1tlqs3IWC2UfZe W5lbrzIPioVc7mQTl4xEabb2tORS9gB05JmzNb21ZOY8uCKMSkokUYbxDNjz2cNpIfcr5qJsE0I ICPAwqaodurl3OlYu6izb8QkuMZZZSxVELYQKDXNpDTs8XbYH6D/IC5VesTM/MRO6IOMnBqXXP9 mVvcg8Iw+9XvvsQ1JIre338mnFv76/p+ryEQOM= X-Received: by 2002:a05:6512:2315:b0:5b1:5a31:8603 with SMTP id 2adb3069b0e04-5b45914b27cmr88124e87.55.1786653810310; Thu, 13 Aug 2026 13:43:30 -0700 (PDT) Received: from ribalda.c.googlers.com (11.36.88.34.bc.googleusercontent.com. [34.88.36.11]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-5b458bac84fsm102509e87.37.2026.08.13.13.43.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 13 Aug 2026 13:43:28 -0700 (PDT) From: Ricardo Ribalda Date: Thu, 13 Aug 2026 20:43:24 +0000 Subject: [PATCH] media: uvcvideo: Do not read beyond the uvc_status_control memory Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260813-uvc-status-11-v1-1-2cf43e9590b0@chromium.org> X-B4-Tracking: v=1; b=H4sIAGssfmoC/x3MQQqAIBBA0avIrBtIg8quEi2sppqNhVMSiHdPW r7F/wmEApPAoBIEiix8+gJdKVgO53dCXovB1Kate93gExeU292PoNZo7WzJdK4nZ6E0V6CN3/8 3Tjl/2Ap7Fl8AAAA= X-Change-ID: 20260813-uvc-status-11-99b9e27a8ea9 To: Laurent Pinchart , Hans de Goede , Mauro Carvalho Chehab , Guennadi Liakhovetski Cc: Mauro Carvalho Chehab , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Ricardo Ribalda X-Mailer: b4 0.14.3 When we receive an event from the camera we only receive 11 bytes. If a v4l2 control is mapped into a UVC control beyond those 11 bytes, right now the code is blindly reading those. Add a check in the event handler to ignore controls that are not available in those 11 bytes. Cc: stable@vger.kernel.org Closes: https://sashiko.dev/#/patchset/F0F008459FFA835D%2B20260813074632.20= 21311-1-raoxu%40uniontech.com Fixes: e5225c820c05 ("media: uvcvideo: Send a control event when a Control = Change interrupt arrives") Signed-off-by: Ricardo Ribalda --- drivers/media/usb/uvc/uvc_ctrl.c | 4 +++- drivers/media/usb/uvc/uvcvideo.h | 3 ++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_c= trl.c index 3ca108b83f1d..3061f388f57b 100644 --- a/drivers/media/usb/uvc/uvc_ctrl.c +++ b/drivers/media/usb/uvc/uvc_ctrl.c @@ -2158,7 +2158,9 @@ void uvc_ctrl_status_event(struct uvc_video_chain *ch= ain, list_for_each_entry(mapping, &ctrl->info.mappings, list) { s32 value; =20 - if (uvc_ctrl_mapping_is_compound(mapping)) + if (uvc_ctrl_mapping_is_compound(mapping) || + DIV_ROUND_UP(mapping->offset + mapping->size, 8) > + UVC_STATUS_CONTROL_LEN) value =3D 0; else value =3D uvc_mapping_get_s32(mapping, UVC_GET_CUR, data); diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvi= deo.h index b6bcee4a222f..ae5e6b6fdd98 100644 --- a/drivers/media/usb/uvc/uvcvideo.h +++ b/drivers/media/usb/uvc/uvcvideo.h @@ -559,10 +559,11 @@ struct uvc_status_streaming { u8 button; } __packed; =20 +#define UVC_STATUS_CONTROL_LEN 11 struct uvc_status_control { u8 bSelector; u8 bAttribute; - u8 bValue[11]; + u8 bValue[UVC_STATUS_CONTROL_LEN]; } __packed; =20 struct uvc_status { --- base-commit: 7b1734e1761258d78651263706182f1d772c0d3b change-id: 20260813-uvc-status-11-99b9e27a8ea9 Best regards, --=20 Ricardo Ribalda