From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 19 Sep 2019 21:08:39 +0000 (+0200)
Subject: 4.4-stable patches
X-Git-Tag: v4.4.194~11
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b1273022345a95a84b83a01ae202ddb03c6d71f3;p=thirdparty%2Fkernel%2Fstable-queue.git

4.4-stable patches

added patches:
	media-technisat-usb2-break-out-of-loop-at-end-of-buffer.patch
---

diff --git a/queue-4.4/media-technisat-usb2-break-out-of-loop-at-end-of-buffer.patch b/queue-4.4/media-technisat-usb2-break-out-of-loop-at-end-of-buffer.patch
new file mode 100644
index 00000000000..551c8ce1977
--- /dev/null
+++ b/queue-4.4/media-technisat-usb2-break-out-of-loop-at-end-of-buffer.patch
@@ -0,0 +1,71 @@
+From 0c4df39e504bf925ab666132ac3c98d6cbbe380b Mon Sep 17 00:00:00 2001
+From: Sean Young <sean@mess.org>
+Date: Wed, 3 Jul 2019 10:52:39 -0400
+Subject: media: technisat-usb2: break out of loop at end of buffer
+
+From: Sean Young <sean@mess.org>
+
+commit 0c4df39e504bf925ab666132ac3c98d6cbbe380b upstream.
+
+Ensure we do not access the buffer beyond the end if no 0xff byte
+is encountered.
+
+Reported-by: syzbot+eaaaf38a95427be88f4b@syzkaller.appspotmail.com
+Signed-off-by: Sean Young <sean@mess.org>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/dvb-usb/technisat-usb2.c |   21 ++++++++++-----------
+ 1 file changed, 10 insertions(+), 11 deletions(-)
+
+--- a/drivers/media/usb/dvb-usb/technisat-usb2.c
++++ b/drivers/media/usb/dvb-usb/technisat-usb2.c
+@@ -594,9 +594,9 @@ static int technisat_usb2_frontend_attac
+ 
+ static int technisat_usb2_get_ir(struct dvb_usb_device *d)
+ {
+-	u8 buf[62], *b;
+-	int ret;
++	u8 buf[62];
+ 	struct ir_raw_event ev;
++	int i, ret;
+ 
+ 	buf[0] = GET_IR_DATA_VENDOR_REQUEST;
+ 	buf[1] = 0x08;
+@@ -632,26 +632,25 @@ unlock:
+ 		return 0; /* no key pressed */
+ 
+ 	/* decoding */
+-	b = buf+1;
+ 
+ #if 0
+ 	deb_rc("RC: %d ", ret);
+-	debug_dump(b, ret, deb_rc);
++	debug_dump(buf + 1, ret, deb_rc);
+ #endif
+ 
+ 	ev.pulse = 0;
+-	while (1) {
+-		ev.pulse = !ev.pulse;
+-		ev.duration = (*b * FIRMWARE_CLOCK_DIVISOR * FIRMWARE_CLOCK_TICK) / 1000;
+-		ir_raw_event_store(d->rc_dev, &ev);
+-
+-		b++;
+-		if (*b == 0xff) {
++	for (i = 1; i < ARRAY_SIZE(buf); i++) {
++		if (buf[i] == 0xff) {
+ 			ev.pulse = 0;
+ 			ev.duration = 888888*2;
+ 			ir_raw_event_store(d->rc_dev, &ev);
+ 			break;
+ 		}
++
++		ev.pulse = !ev.pulse;
++		ev.duration = (buf[i] * FIRMWARE_CLOCK_DIVISOR *
++			       FIRMWARE_CLOCK_TICK) / 1000;
++		ir_raw_event_store(d->rc_dev, &ev);
+ 	}
+ 
+ 	ir_raw_event_handle(d->rc_dev);
diff --git a/queue-4.4/series b/queue-4.4/series
index bf4e718fcc2..bdbee9fe205 100644
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -52,3 +52,4 @@ net-seeq-fix-the-function-used-to-release-some-memor.patch
 dmaengine-ti-omap-dma-add-cleanup-in-omap_dma_probe.patch
 keys-fix-missing-null-pointer-check-in-request_key_a.patch
 floppy-fix-usercopy-direction.patch
+media-technisat-usb2-break-out-of-loop-at-end-of-buffer.patch