Received: by 2002:a17:90a:1609:0:0:0:0 with SMTP id n9csp848681pja; Wed, 1 Apr 2020 09:47:47 -0700 (PDT) X-Google-Smtp-Source: ADFU+vvToeSgNkThoLsz/FpDXvwcE9fX41ZIkApu17DQjSQaSZsFg9pEH/w6WkP3CTFW9TLg5nr7 X-Received: by 2002:a9d:6e8f:: with SMTP id a15mr13743354otr.188.1585759667059; Wed, 01 Apr 2020 09:47:47 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1585759667; cv=none; d=google.com; s=arc-20160816; b=g9kZMAbk8v944TKBfcUIrPcZHc0L6yvt/9sbBgGY0M48JFJW0ECvT898J90WTLEbEe T+5PcDEqBmx3OtZvp9ax+e9R1fsJrfJq8Qw7yp0DN68b6HbJRwnxFRqD7HgMxgITJwlN gB80M5KzyfzecxfPdaXXZJbrwRT+U7jYma6WXGg7zFDFBN8Tlkq0TEiF7kNvExowO03w smKhZ+nRgjuk2t3EwLN7Joq9fB3UusdU6keQqbN4Y6l2xq7pX0+kuH3+6DVgg8KprHNj LOO478BOreFhpW+/9CYDdacPtLj7raSBDf1KYUqfozUzEbDlCjFcpARuic8rAX3dgA+w SGug== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=ht/ZfUp1jkFq3hKUNvTflX1li6y1U3ahlKDV5h7DseM=; b=YK1GKtDaG993K4shfdB/UONvppn9zrLv5X1ujyxJQBaZzeME+lsHBkmqZdfbrqMRcV C725kPP+dpRox2q/fpenjSiaQ9IYCswOvS+k450c5rJdJnU/83rm9HuGgsIfOJoH/daO QPFNuSmw+rTtRIbuyOQfZ+zcbKWQD3FFygxpxKjJOpi9qDskkwHadHKipvwOfc135mUh zJXQTMERTr+02TiMH4BjH4siMDcQo3dE4ijvB9Tfyrj4pARRgzDyHbnIr1EOWH5/9P+i k1B4agZOIeDdS7f6sF8wI1ToqHnl9QGJ7944JW1Y0+Jpb1j6doIcoaEhSMWjnCPHfBTW SGfQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=d+yDk0So; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id x136si1094486oif.122.2020.04.01.09.47.34; Wed, 01 Apr 2020 09:47:47 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=d+yDk0So; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389950AbgDAQqb (ORCPT + 99 others); Wed, 1 Apr 2020 12:46:31 -0400 Received: from mail.kernel.org ([198.145.29.99]:47886 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389704AbgDAQqa (ORCPT ); Wed, 1 Apr 2020 12:46:30 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 892E52063A; Wed, 1 Apr 2020 16:46:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759589; bh=q8ZsOnGtELYqLjvv1D7JOC+mmwvjB+KAtZ0LjT4MxYE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=d+yDk0SoETHeOPVsI6qHaEzcq01gUoS1jgfnkB+6JrkS3ksKzHuncf+5CR+sKIoF2 3luZbXgFfOBrKu5xQNd9RU7KBgdmoVMJbhLLrmnZ87LFg5Pcszh33L+2bC7nbapbie hpdmU150wlgj2osC9NrKBqVS225J6VfuLELo8JSk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hans de Goede , Johan Hovold , Hans Verkuil , Mauro Carvalho Chehab Subject: [PATCH 4.14 128/148] media: stv06xx: add missing descriptor sanity checks Date: Wed, 1 Apr 2020 18:18:40 +0200 Message-Id: <20200401161604.670990661@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161552.245876366@linuxfoundation.org> References: <20200401161552.245876366@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Johan Hovold commit 485b06aadb933190f4bc44e006076bc27a23f205 upstream. Make sure to check that we have two alternate settings and at least one endpoint before accessing the second altsetting structure and dereferencing the endpoint arrays. This specifically avoids dereferencing NULL-pointers or corrupting memory when a device does not have the expected descriptors. Note that the sanity checks in stv06xx_start() and pb0100_start() are not redundant as the driver is mixing looking up altsettings by index and by number, which may not coincide. Fixes: 8668d504d72c ("V4L/DVB (12082): gspca_stv06xx: Add support for st6422 bridge and sensor") Fixes: c0b33bdc5b8d ("[media] gspca-stv06xx: support bandwidth changing") Cc: stable # 2.6.31 Cc: Hans de Goede Signed-off-by: Johan Hovold Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman --- drivers/media/usb/gspca/stv06xx/stv06xx.c | 19 ++++++++++++++++++- drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c | 4 ++++ 2 files changed, 22 insertions(+), 1 deletion(-) --- a/drivers/media/usb/gspca/stv06xx/stv06xx.c +++ b/drivers/media/usb/gspca/stv06xx/stv06xx.c @@ -289,6 +289,9 @@ static int stv06xx_start(struct gspca_de return -EIO; } + if (alt->desc.bNumEndpoints < 1) + return -ENODEV; + packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize); err = stv06xx_write_bridge(sd, STV_ISO_SIZE_L, packet_size); if (err < 0) @@ -313,11 +316,21 @@ out: static int stv06xx_isoc_init(struct gspca_dev *gspca_dev) { + struct usb_interface_cache *intfc; struct usb_host_interface *alt; struct sd *sd = (struct sd *) gspca_dev; + intfc = gspca_dev->dev->actconfig->intf_cache[0]; + + if (intfc->num_altsetting < 2) + return -ENODEV; + + alt = &intfc->altsetting[1]; + + if (alt->desc.bNumEndpoints < 1) + return -ENODEV; + /* Start isoc bandwidth "negotiation" at max isoc bandwidth */ - alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1]; alt->endpoint[0].desc.wMaxPacketSize = cpu_to_le16(sd->sensor->max_packet_size[gspca_dev->curr_mode]); @@ -330,6 +343,10 @@ static int stv06xx_isoc_nego(struct gspc struct usb_host_interface *alt; struct sd *sd = (struct sd *) gspca_dev; + /* + * Existence of altsetting and endpoint was verified in + * stv06xx_isoc_init() + */ alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1]; packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize); min_packet_size = sd->sensor->min_packet_size[gspca_dev->curr_mode]; --- a/drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c +++ b/drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c @@ -194,6 +194,10 @@ static int pb0100_start(struct sd *sd) alt = usb_altnum_to_altsetting(intf, sd->gspca_dev.alt); if (!alt) return -ENODEV; + + if (alt->desc.bNumEndpoints < 1) + return -ENODEV; + packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize); /* If we don't have enough bandwidth use a lower framerate */