From 20065288e69b3481104f54c535e9e3252c21ae1c Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 3 Nov 2021 10:58:15 +0100 Subject: [PATCH] 5.4-stable patches added patches: media-firewire-firedtv-avc-fix-a-buffer-overflow-in-avc_ca_pmt.patch --- ...-fix-a-buffer-overflow-in-avc_ca_pmt.patch | 84 +++++++++++++++++++ queue-5.4/series | 1 + 2 files changed, 85 insertions(+) create mode 100644 queue-5.4/media-firewire-firedtv-avc-fix-a-buffer-overflow-in-avc_ca_pmt.patch diff --git a/queue-5.4/media-firewire-firedtv-avc-fix-a-buffer-overflow-in-avc_ca_pmt.patch b/queue-5.4/media-firewire-firedtv-avc-fix-a-buffer-overflow-in-avc_ca_pmt.patch new file mode 100644 index 00000000000..d6e4d7c12ed --- /dev/null +++ b/queue-5.4/media-firewire-firedtv-avc-fix-a-buffer-overflow-in-avc_ca_pmt.patch @@ -0,0 +1,84 @@ +From 35d2969ea3c7d32aee78066b1f3cf61a0d935a4e Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 7 Jun 2021 17:23:48 +0200 +Subject: media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt() + +From: Dan Carpenter + +commit 35d2969ea3c7d32aee78066b1f3cf61a0d935a4e upstream. + +The bounds checking in avc_ca_pmt() is not strict enough. It should +be checking "read_pos + 4" because it's reading 5 bytes. If the +"es_info_length" is non-zero then it reads a 6th byte so there needs to +be an additional check for that. + +I also added checks for the "write_pos". I don't think these are +required because "read_pos" and "write_pos" are tied together so +checking one ought to be enough. But they make the code easier to +understand for me. The check on write_pos is: + + if (write_pos + 4 >= sizeof(c->operand) - 4) { + +The first "+ 4" is because we're writing 5 bytes and the last " - 4" +is to leave space for the CRC. + +The other problem is that "length" can be invalid. It comes from +"data_length" in fdtv_ca_pmt(). + +Cc: stable@vger.kernel.org +Reported-by: Luo Likang +Signed-off-by: Dan Carpenter +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/firewire/firedtv-avc.c | 14 +++++++++++--- + drivers/media/firewire/firedtv-ci.c | 2 ++ + 2 files changed, 13 insertions(+), 3 deletions(-) + +--- a/drivers/media/firewire/firedtv-avc.c ++++ b/drivers/media/firewire/firedtv-avc.c +@@ -1165,7 +1165,11 @@ int avc_ca_pmt(struct firedtv *fdtv, cha + read_pos += program_info_length; + write_pos += program_info_length; + } +- while (read_pos < length) { ++ while (read_pos + 4 < length) { ++ if (write_pos + 4 >= sizeof(c->operand) - 4) { ++ ret = -EINVAL; ++ goto out; ++ } + c->operand[write_pos++] = msg[read_pos++]; + c->operand[write_pos++] = msg[read_pos++]; + c->operand[write_pos++] = msg[read_pos++]; +@@ -1177,13 +1181,17 @@ int avc_ca_pmt(struct firedtv *fdtv, cha + c->operand[write_pos++] = es_info_length >> 8; + c->operand[write_pos++] = es_info_length & 0xff; + if (es_info_length > 0) { ++ if (read_pos >= length) { ++ ret = -EINVAL; ++ goto out; ++ } + pmt_cmd_id = msg[read_pos++]; + if (pmt_cmd_id != 1 && pmt_cmd_id != 4) + dev_err(fdtv->device, "invalid pmt_cmd_id %d at stream level\n", + pmt_cmd_id); + +- if (es_info_length > sizeof(c->operand) - 4 - +- write_pos) { ++ if (es_info_length > sizeof(c->operand) - 4 - write_pos || ++ es_info_length > length - read_pos) { + ret = -EINVAL; + goto out; + } +--- a/drivers/media/firewire/firedtv-ci.c ++++ b/drivers/media/firewire/firedtv-ci.c +@@ -134,6 +134,8 @@ static int fdtv_ca_pmt(struct firedtv *f + } else { + data_length = msg->msg[3]; + } ++ if (data_length > sizeof(msg->msg) - data_pos) ++ return -EINVAL; + + return avc_ca_pmt(fdtv, &msg->msg[data_pos], data_length); + } diff --git a/queue-5.4/series b/queue-5.4/series index 64a9c9fe822..4c87741e6be 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -1,3 +1,4 @@ scsi-core-put-lld-module-refcnt-after-scsi-device-is-released.patch vrf-revert-reset-skb-conntrack-connection.patch net-ethernet-microchip-lan743x-fix-skb-allocation-failure.patch +media-firewire-firedtv-avc-fix-a-buffer-overflow-in-avc_ca_pmt.patch -- 2.47.3