lkml.org 
[lkml]   [2017]   [Aug]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 037/134] [media] cx231xx-audio: fix NULL-deref at probe
    3.16.47-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Johan Hovold <johan@kernel.org>

    commit 65f921647f4c89a2068478c89691f39b309b58f7 upstream.

    Make sure to check the number of endpoints to avoid dereferencing a
    NULL-pointer or accessing memory beyond the endpoint array should a
    malicious device lack the expected endpoints.

    Fixes: e0d3bafd0258 ("V4L/DVB (10954): Add cx231xx USB driver")

    Cc: Sri Deevi <Srinivasa.Deevi@conexant.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/media/usb/cx231xx/cx231xx-audio.c | 17 +++++++++++++++--
    1 file changed, 15 insertions(+), 2 deletions(-)

    --- a/drivers/media/usb/cx231xx/cx231xx-audio.c
    +++ b/drivers/media/usb/cx231xx/cx231xx-audio.c
    @@ -699,6 +699,11 @@ static int cx231xx_audio_init(struct cx2
    hs_config_info[0].interface_info.
    audio_index + 1];

    + if (uif->altsetting[0].desc.bNumEndpoints < isoc_pipe + 1) {
    + err = -ENODEV;
    + goto err_free_card;
    + }
    +
    adev->end_point_addr =
    uif->altsetting[0].endpoint[isoc_pipe].desc.
    bEndpointAddress;
    @@ -714,8 +719,14 @@ static int cx231xx_audio_init(struct cx2
    }

    for (i = 0; i < adev->num_alt; i++) {
    - u16 tmp =
    - le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].desc.
    + u16 tmp;
    +
    + if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe + 1) {
    + err = -ENODEV;
    + goto err_free_pkt_size;
    + }
    +
    + tmp = le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].desc.
    wMaxPacketSize);
    adev->alt_max_pkt_size[i] =
    (tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1);
    @@ -725,6 +736,8 @@ static int cx231xx_audio_init(struct cx2

    return 0;

    +err_free_pkt_size:
    + kfree(adev->alt_max_pkt_size);
    err_free_card:
    snd_card_free(card);

    \
     
     \ /
      Last update: 2017-08-18 15:54    [W:4.024 / U:0.000 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site