Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1738358
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.18 35/42] media: uvcvideo: Prevent heap overflow when accessing mapped controls |
| Date | 2017-09-24 22:40 +0200 |
| Message-ID | <utlR4-4Ti-135@gated-at.bofh.it> (permalink) |
| References | <utlHj-4Np-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <linux@roeck-us.net>
commit 7e09f7d5c790278ab98e5f2c22307ebe8ad6e8ba upstream.
The size of uvc_control_mapping is user controlled leading to a
potential heap overflow in the uvc driver. This adds a check to verify
the user provided size fits within the bounds of the defined buffer
size.
Originally-from: Richard Simmons <rssimmo@amazon.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/uvc/uvc_ctrl.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/media/usb/uvc/uvc_ctrl.c
+++ b/drivers/media/usb/uvc/uvc_ctrl.c
@@ -2001,6 +2001,13 @@ int uvc_ctrl_add_mapping(struct uvc_vide
goto done;
}
+ /* Validate the user-provided bit-size and offset */
+ if (mapping->size > 32 ||
+ mapping->offset + mapping->size > ctrl->info.size * 8) {
+ ret = -EINVAL;
+ goto done;
+ }
+
list_for_each_entry(map, &ctrl->info.mappings, list) {
if (mapping->id == map->id) {
uvc_trace(UVC_TRACE_CONTROL, "Can't add mapping '%s', "
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 3.18 00/42] 3.18.72-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:30 +0200
[PATCH 3.18 11/42] [PATCH - RESEND] crypto: AF_ALG - remove SGL terminator indicator when chaining Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:30 +0200
[PATCH 3.18 25/42] scsi: sg: use standard lists for sg_requests Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:30 +0200
[PATCH 3.18 03/42] Revert "net: phy: Correctly process PHY_HALTED in phy_stop_machine()" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:30 +0200
[PATCH 3.18 42/42] mac80211: flush hw_roc_start work before cancelling the ROC Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:30 +0200
[PATCH 3.18 05/42] ipv6: fix memory leak with multiple tables during netns destruction Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:30 +0200
[PATCH 3.18 27/42] scsi: sg: factor out sg_fill_request_table() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:30 +0200
[PATCH 3.18 12/42] ext4: fix incorrect quotaoff if the quota feature is enabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:30 +0200
[PATCH 3.18 01/42] ipv6: accept 64k - 1 packet length in ip6_find_1stfragopt() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:30 +0200
[PATCH 3.18 21/42] scsi: zfcp: fix payload with full FCP_RSP IU in SCSI trace records Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:30 +0200
[PATCH 3.18 29/42] scsi: qla2xxx: Fix an integer overflow in sysfs code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:30 +0200
[PATCH 3.18 08/42] [PATCH] Revert "usb: musb: fix tx fifo flush handling again" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:30 +0200
[PATCH 3.18 16/42] skd: Avoid that module unloading triggers a use-after-free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:30 +0200
[PATCH 3.18 30/42] ftrace: Fix selftest goto location on error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:40 +0200
[PATCH 3.18 07/42] f2fs: check hot_data for roll-forward recovery Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:40 +0200
[PATCH 3.18 37/42] bcache: Fix leak of bdev reference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:40 +0200
[PATCH 3.18 40/42] bcache: fix for gc and write-back race Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:40 +0200
[PATCH 3.18 39/42] bcache: Correct return value for sysfs attach errors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:40 +0200
[PATCH 3.18 41/42] bcache: fix bch_hprint crash and improve output Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:40 +0200
[PATCH 3.18 33/42] PCI: shpchp: Enable bridge bus mastering if MSI is enabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:40 +0200
[PATCH 3.18 06/42] ipv6: fix typo in fib6_net_exit() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:40 +0200
[PATCH 3.18 31/42] tracing: Apply trace_clock changes to instance max buffer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:40 +0200
[PATCH 3.18 38/42] bcache: correct cache_dirty_target in __update_writeback_rate() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:40 +0200
[PATCH 3.18 32/42] ARC: Re-enable MMU upon Machine Check exception Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:40 +0200
[PATCH 3.18 28/42] scsi: sg: fixup infoleak when using SG_GET_REQUEST_TABLE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:40 +0200
[PATCH 3.18 34/42] media: v4l2-compat-ioctl32: Fix timespec conversion Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:40 +0200
[PATCH 3.18 04/42] tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:40 +0200
[PATCH 3.18 35/42] media: uvcvideo: Prevent heap overflow when accessing mapped controls Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:40 +0200
[PATCH 3.18 24/42] scsi: sg: remove save_scat_len Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:40 +0200
[PATCH 3.18 14/42] block: Relax a check in blk_start_queue() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:40 +0200
[PATCH 3.18 18/42] scsi: zfcp: fix queuecommand for scsi_eh commands when DIX enabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:40 +0200
[PATCH 3.18 22/42] scsi: zfcp: trace HBA FSF response by default on dismiss or timedout late response Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:40 +0200
[PATCH 3.18 26/42] scsi: sg: off by one in sg_ioctl() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:40 +0200
[PATCH 3.18 23/42] scsi: zfcp: trace high part of "new" 64 bit SCSI LUN Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:40 +0200
[PATCH 3.18 02/42] qlge: avoid memcpy buffer overflow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:40 +0200
[PATCH 3.18 13/42] powerpc: Fix DAR reporting when alignment handler faults Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:40 +0200
Re: [PATCH 3.18 00/42] 3.18.72-stable review Guenter Roeck <linux@roeck-us.net> - 2017-09-25 03:10 +0200
Re: [PATCH 3.18 00/42] 3.18.72-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-25 08:40 +0200
Re: [PATCH 3.18 00/42] 3.18.72-stable review Guenter Roeck <linux@roeck-us.net> - 2017-09-25 13:10 +0200
Re: [PATCH 3.18 00/42] 3.18.72-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-25 14:30 +0200
Re: [PATCH 3.18 00/42] 3.18.72-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-09-26 01:20 +0200
csiph-web