From ff2ba4819775eb61ccae92332d2a1075f3a3bf82 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 6 Feb 2020 16:05:29 +0100 Subject: [PATCH] 4.4-stable patches added patches: media-uvcvideo-avoid-cyclic-entity-chains-due-to-malformed-usb-descriptors.patch mfd-dln2-more-sanity-checking-for-endpoints.patch --- ...ins-due-to-malformed-usb-descriptors.patch | 114 ++++++++++++++++++ ...2-more-sanity-checking-for-endpoints.patch | 55 +++++++++ queue-4.4/series | 2 + 3 files changed, 171 insertions(+) create mode 100644 queue-4.4/media-uvcvideo-avoid-cyclic-entity-chains-due-to-malformed-usb-descriptors.patch create mode 100644 queue-4.4/mfd-dln2-more-sanity-checking-for-endpoints.patch diff --git a/queue-4.4/media-uvcvideo-avoid-cyclic-entity-chains-due-to-malformed-usb-descriptors.patch b/queue-4.4/media-uvcvideo-avoid-cyclic-entity-chains-due-to-malformed-usb-descriptors.patch new file mode 100644 index 00000000000..ce18b20751e --- /dev/null +++ b/queue-4.4/media-uvcvideo-avoid-cyclic-entity-chains-due-to-malformed-usb-descriptors.patch @@ -0,0 +1,114 @@ +From 68035c80e129c4cfec659aac4180354530b26527 Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Fri, 8 Nov 2019 16:48:38 +0100 +Subject: media: uvcvideo: Avoid cyclic entity chains due to malformed USB descriptors + +From: Will Deacon + +commit 68035c80e129c4cfec659aac4180354530b26527 upstream. + +Way back in 2017, fuzzing the 4.14-rc2 USB stack with syzkaller kicked +up the following WARNING from the UVC chain scanning code: + + | list_add double add: new=ffff880069084010, prev=ffff880069084010, + | next=ffff880067d22298. + | ------------[ cut here ]------------ + | WARNING: CPU: 1 PID: 1846 at lib/list_debug.c:31 __list_add_valid+0xbd/0xf0 + | Modules linked in: + | CPU: 1 PID: 1846 Comm: kworker/1:2 Not tainted + | 4.14.0-rc2-42613-g1488251d1a98 #238 + | Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 + | Workqueue: usb_hub_wq hub_event + | task: ffff88006b01ca40 task.stack: ffff880064358000 + | RIP: 0010:__list_add_valid+0xbd/0xf0 lib/list_debug.c:29 + | RSP: 0018:ffff88006435ddd0 EFLAGS: 00010286 + | RAX: 0000000000000058 RBX: ffff880067d22298 RCX: 0000000000000000 + | RDX: 0000000000000058 RSI: ffffffff85a58800 RDI: ffffed000c86bbac + | RBP: ffff88006435dde8 R08: 1ffff1000c86ba52 R09: 0000000000000000 + | R10: 0000000000000002 R11: 0000000000000000 R12: ffff880069084010 + | R13: ffff880067d22298 R14: ffff880069084010 R15: ffff880067d222a0 + | FS: 0000000000000000(0000) GS:ffff88006c900000(0000) knlGS:0000000000000000 + | CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + | CR2: 0000000020004ff2 CR3: 000000006b447000 CR4: 00000000000006e0 + | Call Trace: + | __list_add ./include/linux/list.h:59 + | list_add_tail+0x8c/0x1b0 ./include/linux/list.h:92 + | uvc_scan_chain_forward.isra.8+0x373/0x416 + | drivers/media/usb/uvc/uvc_driver.c:1471 + | uvc_scan_chain drivers/media/usb/uvc/uvc_driver.c:1585 + | uvc_scan_device drivers/media/usb/uvc/uvc_driver.c:1769 + | uvc_probe+0x77f2/0x8f00 drivers/media/usb/uvc/uvc_driver.c:2104 + +Looking into the output from usbmon, the interesting part is the +following data packet: + + ffff880069c63e00 30710169 C Ci:1:002:0 0 143 = 09028f00 01030080 + 00090403 00000e01 00000924 03000103 7c003328 010204db + +If we drop the lead configuration and interface descriptors, we're left +with an output terminal descriptor describing a generic display: + + /* Output terminal descriptor */ + buf[0] 09 + buf[1] 24 + buf[2] 03 /* UVC_VC_OUTPUT_TERMINAL */ + buf[3] 00 /* ID */ + buf[4] 01 /* type == 0x0301 (UVC_OTT_DISPLAY) */ + buf[5] 03 + buf[6] 7c + buf[7] 00 /* source ID refers to self! */ + buf[8] 33 + +The problem with this descriptor is that it is self-referential: the +source ID of 0 matches itself! This causes the 'struct uvc_entity' +representing the display to be added to its chain list twice during +'uvc_scan_chain()': once via 'uvc_scan_chain_entity()' when it is +processed directly from the 'dev->entities' list and then again +immediately afterwards when trying to follow the source ID in +'uvc_scan_chain_forward()' + +Add a check before adding an entity to a chain list to ensure that the +entity is not already part of a chain. + +Link: https://lore.kernel.org/linux-media/CAAeHK+z+Si69jUR+N-SjN9q4O+o5KFiNManqEa-PjUta7EOb7A@mail.gmail.com/ + +Cc: +Fixes: c0efd232929c ("V4L/DVB (8145a): USB Video Class driver") +Reported-by: Andrey Konovalov +Signed-off-by: Will Deacon +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/uvc/uvc_driver.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/drivers/media/usb/uvc/uvc_driver.c ++++ b/drivers/media/usb/uvc/uvc_driver.c +@@ -1411,6 +1411,11 @@ static int uvc_scan_chain_forward(struct + break; + if (forward == prev) + continue; ++ if (forward->chain.next || forward->chain.prev) { ++ uvc_trace(UVC_TRACE_DESCR, "Found reference to " ++ "entity %d already in chain.\n", forward->id); ++ return -EINVAL; ++ } + + switch (UVC_ENTITY_TYPE(forward)) { + case UVC_VC_EXTENSION_UNIT: +@@ -1492,6 +1497,13 @@ static int uvc_scan_chain_backward(struc + return -1; + } + ++ if (term->chain.next || term->chain.prev) { ++ uvc_trace(UVC_TRACE_DESCR, "Found reference to " ++ "entity %d already in chain.\n", ++ term->id); ++ return -EINVAL; ++ } ++ + if (uvc_trace_param & UVC_TRACE_PROBE) + printk(" %d", term->id); + diff --git a/queue-4.4/mfd-dln2-more-sanity-checking-for-endpoints.patch b/queue-4.4/mfd-dln2-more-sanity-checking-for-endpoints.patch new file mode 100644 index 00000000000..52f8e920c0f --- /dev/null +++ b/queue-4.4/mfd-dln2-more-sanity-checking-for-endpoints.patch @@ -0,0 +1,55 @@ +From 2b8bd606b1e60ca28c765f69c1eedd7d2a2e9dca Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Thu, 21 Nov 2019 11:28:10 +0100 +Subject: mfd: dln2: More sanity checking for endpoints + +From: Oliver Neukum + +commit 2b8bd606b1e60ca28c765f69c1eedd7d2a2e9dca upstream. + +It is not enough to check for the number of endpoints. +The types must also be correct. + +Reported-and-tested-by: syzbot+48a2851be24583b864dc@syzkaller.appspotmail.com +Signed-off-by: Oliver Neukum +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/dln2.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +--- a/drivers/mfd/dln2.c ++++ b/drivers/mfd/dln2.c +@@ -729,6 +729,8 @@ static int dln2_probe(struct usb_interfa + const struct usb_device_id *usb_id) + { + struct usb_host_interface *hostif = interface->cur_altsetting; ++ struct usb_endpoint_descriptor *epin; ++ struct usb_endpoint_descriptor *epout; + struct device *dev = &interface->dev; + struct dln2_dev *dln2; + int ret; +@@ -738,12 +740,19 @@ static int dln2_probe(struct usb_interfa + hostif->desc.bNumEndpoints < 2) + return -ENODEV; + ++ epin = &hostif->endpoint[0].desc; ++ epout = &hostif->endpoint[1].desc; ++ if (!usb_endpoint_is_bulk_out(epout)) ++ return -ENODEV; ++ if (!usb_endpoint_is_bulk_in(epin)) ++ return -ENODEV; ++ + dln2 = kzalloc(sizeof(*dln2), GFP_KERNEL); + if (!dln2) + return -ENOMEM; + +- dln2->ep_out = hostif->endpoint[0].desc.bEndpointAddress; +- dln2->ep_in = hostif->endpoint[1].desc.bEndpointAddress; ++ dln2->ep_out = epout->bEndpointAddress; ++ dln2->ep_in = epin->bEndpointAddress; + dln2->usb_dev = usb_get_dev(interface_to_usbdev(interface)); + dln2->interface = interface; + usb_set_intfdata(interface, dln2); diff --git a/queue-4.4/series b/queue-4.4/series index 03b407b2ccb..5a7dcd2ae75 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -7,3 +7,5 @@ net-hsr-fix-possible-null-deref-in-hsr_handle_frame.patch net_sched-fix-an-oob-access-in-cls_tcindex.patch tcp-clear-tp-total_retrans-in-tcp_disconnect.patch tcp-clear-tp-segs_-in-out-in-tcp_disconnect.patch +media-uvcvideo-avoid-cyclic-entity-chains-due-to-malformed-usb-descriptors.patch +mfd-dln2-more-sanity-checking-for-endpoints.patch -- 2.47.3