4.14-stable patches

added patches:
	media-firewire-firedtv-avc-fix-a-buffer-overflow-in-avc_ca_pmt.patch

diff --git a/queue-4.14/media-firewire-firedtv-avc-fix-a-buffer-overflow-in-avc_ca_pmt.patch b/queue-4.14/media-firewire-firedtv-avc-fix-a-buffer-overflow-in-avc_ca_pmt.patch
new file mode 100644 (file)
index 0000000..c73512b
--- /dev/null
+++ b/queue-4.14/media-firewire-firedtv-avc-fix-a-buffer-overflow-in-avc_ca_pmt.patch
@@ -0,0 +1,84 @@
+From 35d2969ea3c7d32aee78066b1f3cf61a0d935a4e Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 7 Jun 2021 17:23:48 +0200
+Subject: media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 35d2969ea3c7d32aee78066b1f3cf61a0d935a4e upstream.
+
+The bounds checking in avc_ca_pmt() is not strict enough.  It should
+be checking "read_pos + 4" because it's reading 5 bytes.  If the
+"es_info_length" is non-zero then it reads a 6th byte so there needs to
+be an additional check for that.
+
+I also added checks for the "write_pos".  I don't think these are
+required because "read_pos" and "write_pos" are tied together so
+checking one ought to be enough.  But they make the code easier to
+understand for me.  The check on write_pos is:
+
+       if (write_pos + 4 >= sizeof(c->operand) - 4) {
+
+The first "+ 4" is because we're writing 5 bytes and the last " - 4"
+is to leave space for the CRC.
+
+The other problem is that "length" can be invalid.  It comes from
+"data_length" in fdtv_ca_pmt().
+
+Cc: stable@vger.kernel.org
+Reported-by: Luo Likang <luolikang@nsfocus.com>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/firewire/firedtv-avc.c |   14 +++++++++++---
+ drivers/media/firewire/firedtv-ci.c  |    2 ++
+ 2 files changed, 13 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/firewire/firedtv-avc.c
++++ b/drivers/media/firewire/firedtv-avc.c
+@@ -1169,7 +1169,11 @@ int avc_ca_pmt(struct firedtv *fdtv, cha
+               read_pos += program_info_length;
+               write_pos += program_info_length;
+       }
+-      while (read_pos < length) {
++      while (read_pos + 4 < length) {
++              if (write_pos + 4 >= sizeof(c->operand) - 4) {
++                      ret = -EINVAL;
++                      goto out;
++              }
+               c->operand[write_pos++] = msg[read_pos++];
+               c->operand[write_pos++] = msg[read_pos++];
+               c->operand[write_pos++] = msg[read_pos++];
+@@ -1181,13 +1185,17 @@ int avc_ca_pmt(struct firedtv *fdtv, cha
+               c->operand[write_pos++] = es_info_length >> 8;
+               c->operand[write_pos++] = es_info_length & 0xff;
+               if (es_info_length > 0) {
++                      if (read_pos >= length) {
++                              ret = -EINVAL;
++                              goto out;
++                      }
+                       pmt_cmd_id = msg[read_pos++];
+                       if (pmt_cmd_id != 1 && pmt_cmd_id != 4)
+                               dev_err(fdtv->device, "invalid pmt_cmd_id %d at stream level\n",
+                                       pmt_cmd_id);
+ 
+-                      if (es_info_length > sizeof(c->operand) - 4 -
+-                                           write_pos) {
++                      if (es_info_length > sizeof(c->operand) - 4 - write_pos ||
++                          es_info_length > length - read_pos) {
+                               ret = -EINVAL;
+                               goto out;
+                       }
+--- a/drivers/media/firewire/firedtv-ci.c
++++ b/drivers/media/firewire/firedtv-ci.c
+@@ -138,6 +138,8 @@ static int fdtv_ca_pmt(struct firedtv *f
+       } else {
+               data_length = msg->msg[3];
+       }
++      if (data_length > sizeof(msg->msg) - data_pos)
++              return -EINVAL;
+ 
+       return avc_ca_pmt(fdtv, &msg->msg[data_pos], data_length);
+ }

diff --git a/queue-4.14/series b/queue-4.14/series
index 1175007cafed2991d5ca1cac09f84963649b97c6..ba0803e4e032339b63f2079258f04c27b242798b 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -1 +1,2 @@
 scsi-core-put-lld-module-refcnt-after-scsi-device-is-released.patch
+media-firewire-firedtv-avc-fix-a-buffer-overflow-in-avc_ca_pmt.patch