Received: by 2002:a5d:9c59:0:0:0:0:0 with SMTP id 25csp2266522iof; Wed, 8 Jun 2022 00:54:59 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxmKLuPEGiJiVOaeQbtVSKIgMNtyEXCWlOVMbq1MaLVaSSrifqZs7vtVvfeB0RGDgIBK5/q X-Received: by 2002:a05:6a00:1a4a:b0:518:bbd5:3c1d with SMTP id h10-20020a056a001a4a00b00518bbd53c1dmr33351462pfv.64.1654674899644; Wed, 08 Jun 2022 00:54:59 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1654674899; cv=none; d=google.com; s=arc-20160816; b=ZHy3ishinNso94+NcfO1JAcYwZNQaLIlqxw2dqZ0JEW8QgHd0FUxlO55xD/9p9XsT3 s06qR66+4QdZBSPF2pxowiu+2Q+gmWwwpedaToKLFHO+VjqHzgfeitLuk+xiGbGfQMxQ PeC+bvUd/aR7TL3X/AiLrhZM8FtKv4pJVu595iNFTJRv7rzKTjzNb+VNSnVC71vVPyS4 U+4CmWnF+WlU6mEGa2i3RsuhXeFqTwzmf1t+2ZIgwQPKvaa1vNqnYaZbjZxlgvJ47uWX RdRVbZV2SS2/z3iJZyCm29mQk0x/8BfFW1NwUGI/co+k/bhta6W6g30TDKXYrrFN7NrC 9VOQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=vfjOlh56Eix9Ars1m03LiyImEPneSn57fw/and9EkYU=; b=IPKhY4jx6bkPgF3/x2WXvTxGcZ/Wpmmv67rSUSd6b9Tku5pmVeIDF6euAGZDTV6lNC RyjeD1VmE2IR8LNArlpxiF9VCj9/KqT6EhVYMvwaUMUhZuSKPJHNW3iu/R0IiSu8JnCc 3UgepByYeXPH44PAcYehNyk4nUqQqGkBB61aQzRSN6tc05a6MPbdiZF/0YR5xeB/NJoG sUX+zozDFMOMbt9OjOTTeuiajcAfiL5F8jfhW5L1Gn6iYUl/n8GQPvJAmeJQyJOwXmlX 3Pqa8f4IAohk263savOTOu8tYr7jIX+QELdonlKUKaVu9bo6o/DocLxgPK41tL657gMr WgNA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=Mbq5QyuF; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from lindbergh.monkeyblade.net (lindbergh.monkeyblade.net. [2620:137:e000::1:18]) by mx.google.com with ESMTPS id s6-20020a056a001c4600b0050cfca6a183si22480199pfw.114.2022.06.08.00.54.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 08 Jun 2022 00:54:59 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=Mbq5QyuF; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email [IPv6:2620:137:e000::1:20]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 8A5C51D92E2; Wed, 8 Jun 2022 00:24:18 -0700 (PDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1383443AbiFGWoc (ORCPT + 99 others); Tue, 7 Jun 2022 18:44:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49006 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1381138AbiFGVbj (ORCPT ); Tue, 7 Jun 2022 17:31:39 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BBF3D22CBE2; Tue, 7 Jun 2022 12:04:03 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4FD36617DA; Tue, 7 Jun 2022 19:04:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 50981C385A2; Tue, 7 Jun 2022 19:04:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1654628642; bh=2TsbinJLIFSqXHt2Xuqns8vJvrm0oHS2aRkp0nl59YM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Mbq5QyuFQgaSqrD37aI+0LvlAHcUTmo6zSSJiUEDzuph5wEJqNvafL/fL11RFLjqM MM+TglLg9KDPdXF/4XhDPPzCeo0k9/4ZWlK2nTIJ+GfBO/oVEDS9FgHSaBGDFg7h8K tKYQnU0pb4O0Am131vCDOGkkkzkm4NKt0vJuc44U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Xiaomeng Tong , Laurent Pinchart , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 5.18 402/879] media: uvcvideo: Fix missing check to determine if element is found in list Date: Tue, 7 Jun 2022 18:58:40 +0200 Message-Id: <20220607165014.531527784@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220607165002.659942637@linuxfoundation.org> References: <20220607165002.659942637@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-3.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RDNS_NONE,SPF_HELO_NONE,T_SCC_BODY_TEXT_LINE autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Xiaomeng Tong [ Upstream commit 261f33388c29f6f3c12a724e6d89172b7f6d5996 ] The list iterator will point to a bogus position containing HEAD if the list is empty or the element is not found in list. This case should be checked before any use of the iterator, otherwise it will lead to a invalid memory access. The missing check here is before "pin = iterm->id;", just add check here to fix the security bug. In addition, the list iterator value will *always* be set and non-NULL by list_for_each_entry(), so it is incorrect to assume that the iterator value will be NULL if the element is not found in list, considering the (mis)use here: "if (iterm == NULL". Use a new value 'it' as the list iterator, while use the old value 'iterm' as a dedicated pointer to point to the found element, which 1. can fix this bug, due to 'iterm' is NULL only if it's not found. 2. do not need to change all the uses of 'iterm' after the loop. 3. can also limit the scope of the list iterator 'it' *only inside* the traversal loop by simply declaring 'it' inside the loop in the future, as usage of the iterator outside of the list_for_each_entry is considered harmful. https://lkml.org/lkml/2022/2/17/1032 Fixes: d5e90b7a6cd1c ("[media] uvcvideo: Move to video_ioctl2") Signed-off-by: Xiaomeng Tong Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin --- drivers/media/usb/uvc/uvc_v4l2.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c index 711556d13d03..177181985345 100644 --- a/drivers/media/usb/uvc/uvc_v4l2.c +++ b/drivers/media/usb/uvc/uvc_v4l2.c @@ -871,29 +871,31 @@ static int uvc_ioctl_enum_input(struct file *file, void *fh, struct uvc_video_chain *chain = handle->chain; const struct uvc_entity *selector = chain->selector; struct uvc_entity *iterm = NULL; + struct uvc_entity *it; u32 index = input->index; - int pin = 0; if (selector == NULL || (chain->dev->quirks & UVC_QUIRK_IGNORE_SELECTOR_UNIT)) { if (index != 0) return -EINVAL; - list_for_each_entry(iterm, &chain->entities, chain) { - if (UVC_ENTITY_IS_ITERM(iterm)) + list_for_each_entry(it, &chain->entities, chain) { + if (UVC_ENTITY_IS_ITERM(it)) { + iterm = it; break; + } } - pin = iterm->id; } else if (index < selector->bNrInPins) { - pin = selector->baSourceID[index]; - list_for_each_entry(iterm, &chain->entities, chain) { - if (!UVC_ENTITY_IS_ITERM(iterm)) + list_for_each_entry(it, &chain->entities, chain) { + if (!UVC_ENTITY_IS_ITERM(it)) continue; - if (iterm->id == pin) + if (it->id == selector->baSourceID[index]) { + iterm = it; break; + } } } - if (iterm == NULL || iterm->id != pin) + if (iterm == NULL) return -EINVAL; memset(input, 0, sizeof(*input)); -- 2.35.1