releases/4.20.16/media-uvcvideo-fix-type-check-leading-to-overflow.patch

   1 From 47bb117911b051bbc90764a8bff96543cbd2005f Mon Sep 17 00:00:00 2001
   2 From: Alistair Strachan <astrachan@google.com>
   3 Date: Tue, 18 Dec 2018 20:32:48 -0500
   4 Subject: media: uvcvideo: Fix 'type' check leading to overflow
   5
   6 From: Alistair Strachan <astrachan@google.com>
   7
   8 commit 47bb117911b051bbc90764a8bff96543cbd2005f upstream.
   9
  10 When initially testing the Camera Terminal Descriptor wTerminalType
  11 field (buffer[4]), no mask is used. Later in the function, the MSB is
  12 overloaded to store the descriptor subtype, and so a mask of 0x7fff
  13 is used to check the type.
  14
  15 If a descriptor is specially crafted to set this overloaded bit in the
  16 original wTerminalType field, the initial type check will fail (falling
  17 through, without adjusting the buffer size), but the later type checks
  18 will pass, assuming the buffer has been made suitably large, causing an
  19 overflow.
  20
  21 Avoid this problem by checking for the MSB in the wTerminalType field.
  22 If the bit is set, assume the descriptor is bad, and abort parsing it.
  23
  24 Originally reported here:
  25 https://groups.google.com/forum/#!topic/syzkaller/Ot1fOE6v1d8
  26 A similar (non-compiling) patch was provided at that time.
  27
  28 Reported-by: syzbot <syzkaller@googlegroups.com>
  29 Signed-off-by: Alistair Strachan <astrachan@google.com>
  30 Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  31 Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
  32 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  33
  34 ---
  35  drivers/media/usb/uvc/uvc_driver.c |   14 +++++++++++---
  36  1 file changed, 11 insertions(+), 3 deletions(-)
  37
  38 --- a/drivers/media/usb/uvc/uvc_driver.c
  39 +++ b/drivers/media/usb/uvc/uvc_driver.c
  40 @@ -1065,11 +1065,19 @@ static int uvc_parse_standard_control(st
  41                         return -EINVAL;
  42                 }
  43
  44 -               /* Make sure the terminal type MSB is not null, otherwise it
  45 -                * could be confused with a unit.
  46 +               /*
  47 +                * Reject invalid terminal types that would cause issues:
  48 +                *
  49 +                * - The high byte must be non-zero, otherwise it would be
  50 +                *   confused with a unit.
  51 +                *
  52 +                * - Bit 15 must be 0, as we use it internally as a terminal
  53 +                *   direction flag.
  54 +                *
  55 +                * Other unknown types are accepted.
  56                  */
  57                 type = get_unaligned_le16(&buffer[4]);
  58 -               if ((type & 0xff00) == 0) {
  59 +               if ((type & 0x7f00) == 0 || (type & 0x8000) != 0) {
  60                         uvc_trace(UVC_TRACE_DESCR, "device %d videocontrol "
  61                                 "interface %d INPUT_TERMINAL %d has invalid "
  62                                 "type 0x%04x, skipping\n", udev->devnum,