[PATCH 4.9 65/77] media: uvcvideo: Prevent heap overflow when accessing mapped controls

From	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups	linux.kernel
Subject	[PATCH 4.9 65/77] media: uvcvideo: Prevent heap overflow when accessing mapped controls
Date	2017-09-24 22:50 +0200
Message-ID	<utm0G-4Xd-45@gated-at.bofh.it> (permalink)
References	<utlQZ-4Ti-7@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Guenter Roeck <linux@roeck-us.net>

commit 7e09f7d5c790278ab98e5f2c22307ebe8ad6e8ba upstream.

The size of uvc_control_mapping is user controlled leading to a
potential heap overflow in the uvc driver. This adds a check to verify
the user provided size fits within the bounds of the defined buffer
size.

Originally-from: Richard Simmons <rssimmo@amazon.com>

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/usb/uvc/uvc_ctrl.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/drivers/media/usb/uvc/uvc_ctrl.c
+++ b/drivers/media/usb/uvc/uvc_ctrl.c
@@ -2002,6 +2002,13 @@ int uvc_ctrl_add_mapping(struct uvc_vide
 		goto done;
 	}
 
+	/* Validate the user-provided bit-size and offset */
+	if (mapping->size > 32 ||
+	    mapping->offset + mapping->size > ctrl->info.size * 8) {
+		ret = -EINVAL;
+		goto done;
+	}
+
 	list_for_each_entry(map, &ctrl->info.mappings, list) {
 		if (mapping->id == map->id) {
 			uvc_trace(UVC_TRACE_CONTROL, "Can't add mapping '%s', "

Thread

[PATCH 4.9 00/77] 4.9.52-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:40 +0200
  [PATCH 4.9 60/77] PCI: pciehp: Report power fault only once until we clear it Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:40 +0200
  [PATCH 4.9 30/77] powerpc: Fix DAR reporting when alignment handler faults Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:40 +0200
  [PATCH 4.9 55/77] ftrace: Fix memleak when unregistering dynamic ops when tracing disabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:40 +0200
  [PATCH 4.9 42/77] scsi: zfcp: trace high part of "new" 64 bit SCSI LUN Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:40 +0200
  [PATCH 4.9 54/77] ftrace: Fix selftest goto location on error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:40 +0200
  [PATCH 4.9 75/77] mac80211_hwsim: Use proper TX power Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:40 +0200
  [PATCH 4.9 21/77] MIPS: math-emu: <MADDF|MSUBF>.<D|S>: Fix some cases of infinite inputs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:40 +0200
  [PATCH 4.9 27/77] [PATCH - RESEND] crypto: AF_ALG - remove SGL terminator indicator when  chaining Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:40 +0200
  [PATCH 4.9 04/77] orangefs: Dont clear SGID when inheriting ACLs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:40 +0200
  [PATCH 4.9 06/77] drm/sun4i: Implement drm_driver lastclose to restore fbdev console Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:40 +0200
  [PATCH 4.9 44/77] scsi: megaraid_sas: Check valid aen class range to avoid kernel panic Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:40 +0200
  [PATCH 4.9 63/77] s390/mm: fix race on mm->context.flush_mm Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:50 +0200
  [PATCH 4.9 65/77] media: uvcvideo: Prevent heap overflow when accessing mapped controls Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:50 +0200
  [PATCH 4.9 67/77] bcache: initialize dirty stripes in flash_dev_run() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:50 +0200
  [PATCH 4.9 61/77] net/netfilter/nf_conntrack_core: Fix net_conntrack_lock() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 22:50 +0200
  [PATCH 4.9 56/77] tracing: Add barrier to trace_printk() buffer nesting modification Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
  [PATCH 4.9 68/77] bcache: Fix leak of bdev reference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
  [PATCH 4.9 24/77] MIPS: math-emu: <MADDF|MSUBF>.S: Fix accuracy (32-bit case) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
  [PATCH 4.9 74/77] mac80211: fix VLAN handling with TXQs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
  [PATCH 4.9 59/77] PCI: shpchp: Enable bridge bus mastering if MSI is enabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
  [PATCH 4.9 58/77] ARC: Re-enable MMU upon Machine Check exception Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
  [PATCH 4.9 26/77] crypto: ccp - Fix XTS-AES-128 support on v5 CCPs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
  [PATCH 4.9 66/77] PM / devfreq: Fix memory leak when fail to register device Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
  [PATCH 4.9 64/77] media: v4l2-compat-ioctl32: Fix timespec conversion Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
  [PATCH 4.9 69/77] bcache: do not subtract sectors_to_gc for bypassed IO Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
  [PATCH 4.9 73/77] bcache: fix bch_hprint crash and improve output Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
  [PATCH 4.9 62/77] s390/mm: fix local TLB flushing vs. detach of an mm address space Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
  [PATCH 4.9 57/77] tracing: Apply trace_clock changes to instance max buffer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
  [PATCH 4.9 18/77] MIPS: math-emu: MINA.<D|S>: Fix some cases of infinity and zero inputs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
  [PATCH 4.9 76/77] mac80211: flush hw_roc_start work before cancelling the ROC Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:10 +0200
  [PATCH 4.9 39/77] scsi: zfcp: fix missing trace records for early returns in TMF eh handlers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:20 +0200
  [PATCH 4.9 40/77] scsi: zfcp: fix payload with full FCP_RSP IU in SCSI trace records Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:20 +0200
  [PATCH 4.9 41/77] scsi: zfcp: trace HBA FSF response by default on dismiss or timedout late response Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:20 +0200
  [PATCH 4.9 34/77] skd: Submit requests to firmware before triggering the doorbell Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:20 +0200
  [PATCH 4.9 33/77] skd: Avoid that module unloading triggers a use-after-free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:20 +0200
  [PATCH 4.9 50/77] scsi: sg: factor out sg_fill_request_table() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:20 +0200
  [PATCH 4.9 11/77] pinctrl/amd: save pin registers over suspend/resume Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:20 +0200
  [PATCH 4.9 48/77] scsi: sg: use standard lists for sg_requests Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:20 +0200
  [PATCH 4.9 03/77] mm: prevent double decrease of nr_reserved_highatomic Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:20 +0200
  [PATCH 4.9 35/77] scsi: zfcp: fix queuecommand for scsi_eh commands when DIX enabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:20 +0200
  [PATCH 4.9 47/77] scsi: sg: remove save_scat_len Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:20 +0200
  [PATCH 4.9 17/77] MIPS: math-emu: <MAXA|MINA>.<D|S>: Fix cases of both infinite inputs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:20 +0200
  [PATCH 4.9 45/77] scsi: megaraid_sas: Return pended IOCTLs with cmd_status MFI_STAT_WRONG_STATE in case adapter is dead Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:20 +0200
  [PATCH 4.9 31/77] block: Relax a check in blk_start_queue() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:20 +0200
  [PATCH 4.9 53/77] scsi: qla2xxx: Fix an integer overflow in sysfs code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:20 +0200
  [PATCH 4.9 10/77] tty: fix __tty_insert_flip_char regression Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:20 +0200
  [PATCH 4.9 29/77] ext4: fix quota inconsistency during orphan cleanup for read-only mounts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:20 +0200
  [PATCH 4.9 43/77] scsi: megaraid_sas: set minimum value of resetwaittime to be 1 secs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:20 +0200
  [PATCH 4.9 12/77] Input: i8042 - add Gigabyte P57 to the keyboard reset table Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:20 +0200
  [PATCH 4.9 16/77] MIPS: math-emu: <MAXA|MINA>.<D|S>: Fix cases of input values with opposite signs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:20 +0200
  [PATCH 4.9 15/77] MIPS: math-emu: <MAX|MIN>.<D|S>: Fix cases of both inputs negative Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:20 +0200
  [PATCH 4.9 07/77] IB/addr: Fix setting source address in addr6_resolve() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:20 +0200
  [PATCH 4.9 09/77] tty: improve tty_insert_flip_char() slow path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:20 +0200
  [PATCH 4.9 19/77] MIPS: math-emu: Handle zero accumulator case in MADDF and MSUBF separately Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:20 +0200
  [PATCH 4.9 51/77] scsi: sg: fixup infoleak when using SG_GET_REQUEST_TABLE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:20 +0200
  [PATCH 4.9 28/77] ext4: fix incorrect quotaoff if the quota feature is enabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:20 +0200
  [PATCH 4.9 05/77] IB/{qib, hfi1}: Avoid flow control testing for RDMA write operation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:20 +0200
  [PATCH 4.9 20/77] MIPS: math-emu: <MADDF|MSUBF>.<D|S>: Fix NaN propagation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-24 23:20 +0200
  Re: [PATCH 4.9 00/77] 4.9.52-stable review Guenter Roeck <linux@roeck-us.net> - 2017-09-25 03:10 +0200
  Re: [PATCH 4.9 00/77] 4.9.52-stable review Tom Gall <tom.gall@linaro.org> - 2017-09-25 06:40 +0200
    Re: [PATCH 4.9 00/77] 4.9.52-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-25 08:30 +0200
  Re: [PATCH 4.9 00/77] 4.9.52-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-09-26 01:20 +0200

csiph-web