lkml.org 
[lkml]   [2019]   [Nov]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.3 72/95] media: usbvision: Fix invalid accesses after device disconnect
    Date
    From: Alan Stern <stern@rowland.harvard.edu>

    commit c7a191464078262bf799136317c95824e26a222b upstream.

    The syzbot fuzzer found two invalid-access bugs in the usbvision
    driver. These bugs occur when userspace keeps the device file open
    after the device has been disconnected and usbvision_disconnect() has
    set usbvision->dev to NULL:

    When the device file is closed, usbvision_radio_close() tries
    to issue a usb_set_interface() call, passing the NULL pointer
    as its first argument.

    If userspace performs a querycap ioctl call, vidioc_querycap()
    calls usb_make_path() with the same NULL pointer.

    This patch fixes the problems by making the appropriate tests
    beforehand. Note that vidioc_querycap() is protected by
    usbvision->v4l2_lock, acquired in a higher layer of the V4L2
    subsystem.

    Reported-and-tested-by: syzbot+7fa38a608b1075dfd634@syzkaller.appspotmail.com

    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    CC: <stable@vger.kernel.org>
    Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/media/usb/usbvision/usbvision-video.c | 8 ++++++--
    1 file changed, 6 insertions(+), 2 deletions(-)

    --- a/drivers/media/usb/usbvision/usbvision-video.c
    +++ b/drivers/media/usb/usbvision/usbvision-video.c
    @@ -453,6 +453,9 @@ static int vidioc_querycap(struct file *
    {
    struct usb_usbvision *usbvision = video_drvdata(file);

    + if (!usbvision->dev)
    + return -ENODEV;
    +
    strscpy(vc->driver, "USBVision", sizeof(vc->driver));
    strscpy(vc->card,
    usbvision_device_data[usbvision->dev_model].model_string,
    @@ -1111,8 +1114,9 @@ static int usbvision_radio_close(struct
    mutex_lock(&usbvision->v4l2_lock);
    /* Set packet size to 0 */
    usbvision->iface_alt = 0;
    - usb_set_interface(usbvision->dev, usbvision->iface,
    - usbvision->iface_alt);
    + if (usbvision->dev)
    + usb_set_interface(usbvision->dev, usbvision->iface,
    + usbvision->iface_alt);

    usbvision_audio_off(usbvision);
    usbvision->radio = 0;

    \
     
     \ /
      Last update: 2019-11-27 22:11    [W:4.271 / U:0.260 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site