Received: by 2002:ac0:bc90:0:0:0:0:0 with SMTP id a16csp577009img; Fri, 22 Mar 2019 04:24:01 -0700 (PDT) X-Google-Smtp-Source: APXvYqwy8UGrocj5Zc1KsTBPRRd5vJv8TOgBazAR3/Tp3nGHOuqqR9O8RbgyMajNx7dH1sKd6lcX X-Received: by 2002:a63:7503:: with SMTP id q3mr7781986pgc.98.1553253841373; Fri, 22 Mar 2019 04:24:01 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553253841; cv=none; d=google.com; s=arc-20160816; b=YS6ieD0lbKK+8zfWWa+PUdHHGDGOZh1buBDz6npXaIL0TRtBrfJVk9ZRTEtPiSCDA/ 884yBujhpkTLM0Utaxqeb2YCYVTS5VtHuWebDrKGNlgbqmjisQyuVGuwbJGU1G5rRl5w dp67eO0jNhg3yrHt5gERIKCv0J7tIvNddjXEkd4cwEzquZAbwYbNbWcga4oV35jrMA5l bBPdJZscN43piBVg0pnXa/Ii+HUu9CvzgZMwUCQoVt/dGl58olNUDEi6T2ksfpNJesjj K2/zBydSWH55w+SCeOvKhIzsHolhXxDHsTpwdhTcdtD11VItkDiasJ+6RXFRSTHs/wPH 79+Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=Et9ipt46cmOFxIo1enH+NT8q8o3S5hjqXqSphSqorQc=; b=FnE47qDjWNdHKnFflSZ/hswqYZEmQK1eTRBdwd99mAyS4XQa1/nL4H0flwUNcwULWb 9OYItFFdA6A63H5Eu0uYDbNvz3jJfAz+ayUMJxWGtRFs26MyS8qqksgJmUEe7957Pdfr Rke59G7p24UrIROV+QrqXsQl70FDMV01ipF0hHxV/95E5ZSrEmHwZheF5Vlf/clgWF3t IDFIva6PEmxXKcP4/R7c8D2Dy/YpDcXW5p2P/pXRGiJT7hkk0zxh719dMbSWyjsebzRk 33xGJTOwMXh+pFYW1TQwZQPVop1JzR0Osh/vUoGQ+fqcLnTsTxuWGMKtJ3PCydIdyMcv ptIw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=rqbCEs88; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 33si7150646pls.161.2019.03.22.04.23.43; Fri, 22 Mar 2019 04:24:01 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=rqbCEs88; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728321AbfCVLWO (ORCPT + 99 others); Fri, 22 Mar 2019 07:22:14 -0400 Received: from mail.kernel.org ([198.145.29.99]:48860 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728743AbfCVLWL (ORCPT ); Fri, 22 Mar 2019 07:22:11 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3FC4921916; Fri, 22 Mar 2019 11:22:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553253730; bh=ghVbteYX+eXjRpHKGEuNO9WUlk8jzxVmiWEbFq/1oBg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rqbCEs88ALy36eRokGYuMQTyU44/xdruW5kkRhV3W0FFcPyXvjwgcCV8t60DG/0BF Oy+trjRrfN/clCG9wAFquUyVgT2rivZ2+7N8pKs3oPbjfEC5xlknxcW+O3h9xolsGN p8VK2y4heeSStCCf2lvrrxSthoy+l71JsdUBufzA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot , Alistair Strachan , Laurent Pinchart , Mauro Carvalho Chehab Subject: [PATCH 3.18 054/134] media: uvcvideo: Fix type check leading to overflow Date: Fri, 22 Mar 2019 12:14:27 +0100 Message-Id: <20190322111213.874706687@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190322111210.465931067@linuxfoundation.org> References: <20190322111210.465931067@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Alistair Strachan commit 47bb117911b051bbc90764a8bff96543cbd2005f upstream. When initially testing the Camera Terminal Descriptor wTerminalType field (buffer[4]), no mask is used. Later in the function, the MSB is overloaded to store the descriptor subtype, and so a mask of 0x7fff is used to check the type. If a descriptor is specially crafted to set this overloaded bit in the original wTerminalType field, the initial type check will fail (falling through, without adjusting the buffer size), but the later type checks will pass, assuming the buffer has been made suitably large, causing an overflow. Avoid this problem by checking for the MSB in the wTerminalType field. If the bit is set, assume the descriptor is bad, and abort parsing it. Originally reported here: https://groups.google.com/forum/#!topic/syzkaller/Ot1fOE6v1d8 A similar (non-compiling) patch was provided at that time. Reported-by: syzbot Signed-off-by: Alistair Strachan Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman --- drivers/media/usb/uvc/uvc_driver.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) --- a/drivers/media/usb/uvc/uvc_driver.c +++ b/drivers/media/usb/uvc/uvc_driver.c @@ -977,11 +977,19 @@ static int uvc_parse_standard_control(st return -EINVAL; } - /* Make sure the terminal type MSB is not null, otherwise it - * could be confused with a unit. + /* + * Reject invalid terminal types that would cause issues: + * + * - The high byte must be non-zero, otherwise it would be + * confused with a unit. + * + * - Bit 15 must be 0, as we use it internally as a terminal + * direction flag. + * + * Other unknown types are accepted. */ type = get_unaligned_le16(&buffer[4]); - if ((type & 0xff00) == 0) { + if ((type & 0x7f00) == 0 || (type & 0x8000) != 0) { uvc_trace(UVC_TRACE_DESCR, "device %d videocontrol " "interface %d INPUT_TERMINAL %d has invalid " "type 0x%04x, skipping\n", udev->devnum,