Received: by 2002:a17:90a:1609:0:0:0:0 with SMTP id n9csp848732pja; Wed, 1 Apr 2020 09:47:50 -0700 (PDT) X-Google-Smtp-Source: APiQypI2lh3bFnmpTlgU8RPlnihDhuoMRniNsX776SxadXU3s5gBMhStul0uUK2Yglw/cQP4crm/ X-Received: by 2002:aca:4fc3:: with SMTP id d186mr3290985oib.171.1585759670423; Wed, 01 Apr 2020 09:47:50 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1585759670; cv=none; d=google.com; s=arc-20160816; b=UCQRv4U3eakooEvmTYwIMfUDk4ZS5Ym/LY1Xa6T0DhfUdHgPhuExQgpqe200kK9p9H NEvviZaq94PQN+DXolnkbzaUHFUQlFFlKrC/9NXWv/KxQLnUWnsQProKNAiCDAMCdOaj p8HJIjiZYFjXUhfiTlDEF81ohig5uM7rRsRIA4zMjbBcz7henPJxB0RA2hIwTaIL7IM/ uv19CkAHW1kz7wEavpOogow2getSg13hnDh/L5rRbZiF/S2KjIBEQiKSzm9SvDmRY50H EQjJF1tMWGk6FoDAVJy7JaIqUq7ZUNaaSh6X6CR11PBseVuzL7APSDXdBeSJ05flmdNk Y+ZA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=M1zvAiSFKBTyMkn5FSVoQew8Ht2rN+PZ/fl1P7IkOkU=; b=PYHZmeWZcEEhRhN6U4h1A8jOSSfJCEfgJ4RhII1ZyMDfSUbLGeiLKGbNThOfa9FzOe 9pi7akTySL/aXRDweDXOcENv+MplSkbL/KzYDXZ93eTd03jtt5UvhZaucago6qnfdN24 V7g4c9r0D07TNzLI7FRbwmxtaxXtj1aZhRhtmqTJS65XGwrkhzrzBAOdB+NTDq6vCsQV sewfz53OauqCmghbuLRWpJB/0g+f3mIC6kPNGjCJdVSIqgs1auYB0Uj6se0Cf2y/Ge0M UwaAbAQOuI99dD5ndB7oRGLHBAqT/07RYnN+YtbAjmAzGw64QTHsdugZbHIF3VlDzVsG NOQA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=i2C5vV+s; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id m15si1017033otr.116.2020.04.01.09.47.37; Wed, 01 Apr 2020 09:47:50 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=i2C5vV+s; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389704AbgDAQqg (ORCPT + 99 others); Wed, 1 Apr 2020 12:46:36 -0400 Received: from mail.kernel.org ([198.145.29.99]:47954 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389775AbgDAQqd (ORCPT ); Wed, 1 Apr 2020 12:46:33 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 58C4520705; Wed, 1 Apr 2020 16:46:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759592; bh=BDRnxjkLLGl0cAzOYdMWTic/foUoSslUvI3pJfjCOQI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=i2C5vV+szXHv1ykryvGSCfDtiYcWSM7zLEhzR8y0ZY3ITx38W+k5AsztFvvlpl8R2 U4JCmmb3pB3bvFJxhMSwJ2aTbyKm1/EK+0cSriqhsqVngxsadp3q+SCNk/Rz9KbV9b MNbx0De3MqssIBT9IpBaCf6joJdlLoaYEHUQXgK4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hans de Goede , Johan Hovold , Hans Verkuil , Mauro Carvalho Chehab Subject: [PATCH 4.14 129/148] media: xirlink_cit: add missing descriptor sanity checks Date: Wed, 1 Apr 2020 18:18:41 +0200 Message-Id: <20200401161604.758832162@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161552.245876366@linuxfoundation.org> References: <20200401161552.245876366@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Johan Hovold commit a246b4d547708f33ff4d4b9a7a5dbac741dc89d8 upstream. Make sure to check that we have two alternate settings and at least one endpoint before accessing the second altsetting structure and dereferencing the endpoint arrays. This specifically avoids dereferencing NULL-pointers or corrupting memory when a device does not have the expected descriptors. Note that the sanity check in cit_get_packet_size() is not redundant as the driver is mixing looking up altsettings by index and by number, which may not coincide. Fixes: 659fefa0eb17 ("V4L/DVB: gspca_xirlink_cit: Add support for camera with a bcd version of 0.01") Fixes: 59f8b0bf3c12 ("V4L/DVB: gspca_xirlink_cit: support bandwidth changing for devices with 1 alt setting") Cc: stable # 2.6.37 Cc: Hans de Goede Signed-off-by: Johan Hovold Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman --- drivers/media/usb/gspca/xirlink_cit.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) --- a/drivers/media/usb/gspca/xirlink_cit.c +++ b/drivers/media/usb/gspca/xirlink_cit.c @@ -1451,6 +1451,9 @@ static int cit_get_packet_size(struct gs return -EIO; } + if (alt->desc.bNumEndpoints < 1) + return -ENODEV; + return le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize); } @@ -2634,6 +2637,7 @@ static int sd_start(struct gspca_dev *gs static int sd_isoc_init(struct gspca_dev *gspca_dev) { + struct usb_interface_cache *intfc; struct usb_host_interface *alt; int max_packet_size; @@ -2649,8 +2653,17 @@ static int sd_isoc_init(struct gspca_dev break; } + intfc = gspca_dev->dev->actconfig->intf_cache[0]; + + if (intfc->num_altsetting < 2) + return -ENODEV; + + alt = &intfc->altsetting[1]; + + if (alt->desc.bNumEndpoints < 1) + return -ENODEV; + /* Start isoc bandwidth "negotiation" at max isoc bandwidth */ - alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1]; alt->endpoint[0].desc.wMaxPacketSize = cpu_to_le16(max_packet_size); return 0; @@ -2673,6 +2686,9 @@ static int sd_isoc_nego(struct gspca_dev break; } + /* + * Existence of altsetting and endpoint was verified in sd_isoc_init() + */ alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1]; packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize); if (packet_size <= min_packet_size)