* [PATCH 2/2] Fix a stack buffer overflow bug in check_input_term
@ 2019-08-30 21:47 Hui Peng
2019-08-30 21:47 ` [alsa-devel] " Hui Peng
` (2 more replies)
0 siblings, 3 replies; 9+ messages in thread
From: Hui Peng @ 2019-08-30 21:47 UTC (permalink / raw)
To: stable
Cc: Hui Peng, Mathias Payer, Jaroslav Kysela, Takashi Iwai,
Greg Kroah-Hartman, Wenwen Wang, alsa-devel, linux-kernel
`check_input_term` recursively calls itself with input from
device side (e.g., uac_input_terminal_descriptor.bCSourceID)
as argument (id). In `check_input_term`, if `check_input_term`
is called with the same `id` argument as the caller, it triggers
endless recursive call, resulting kernel space stack overflow.
This patch fixes the bug by adding a bitmap to `struct mixer_build`
to keep track of the checked ids and stop the execution if some id
has been checked (similar to how parse_audio_unit handles unitid
argument).
CVE: CVE-2018-15118
Reported-by: Hui Peng <benquike@gmail.com>
Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
Signed-off-by: Hui Peng <benquike@gmail.com>
---
sound/usb/mixer.c | 29 ++++++++++++++++++++++++-----
1 file changed, 24 insertions(+), 5 deletions(-)
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 10ddec76f906..e24572fd6e30 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -81,6 +81,7 @@ struct mixer_build {
unsigned char *buffer;
unsigned int buflen;
DECLARE_BITMAP(unitbitmap, MAX_ID_ELEMS);
+ DECLARE_BITMAP(termbitmap, MAX_ID_ELEMS);
struct usb_audio_term oterm;
const struct usbmix_name_map *map;
const struct usbmix_selector_map *selector_map;
@@ -709,15 +710,24 @@ static int get_term_name(struct mixer_build *state, struct usb_audio_term *iterm
* parse the source unit recursively until it reaches to a terminal
* or a branched unit.
*/
-static int check_input_term(struct mixer_build *state, int id,
+static int __check_input_term(struct mixer_build *state, int id,
struct usb_audio_term *term)
{
int err;
void *p1;
+ unsigned char *hdr;
memset(term, 0, sizeof(*term));
- while ((p1 = find_audio_control_unit(state, id)) != NULL) {
- unsigned char *hdr = p1;
+ for (;;) {
+ /* a loop in the terminal chain? */
+ if (test_and_set_bit(id, state->termbitmap))
+ return -EINVAL;
+
+ p1 = find_audio_control_unit(state, id);
+ if (!p1)
+ break;
+
+ hdr = p1;
term->id = id;
switch (hdr[2]) {
case UAC_INPUT_TERMINAL:
@@ -732,7 +742,7 @@ static int check_input_term(struct mixer_build *state, int id,
/* call recursively to verify that the
* referenced clock entity is valid */
- err = check_input_term(state, d->bCSourceID, term);
+ err = __check_input_term(state, d->bCSourceID, term);
if (err < 0)
return err;
@@ -764,7 +774,7 @@ static int check_input_term(struct mixer_build *state, int id,
case UAC2_CLOCK_SELECTOR: {
struct uac_selector_unit_descriptor *d = p1;
/* call recursively to retrieve the channel info */
- err = check_input_term(state, d->baSourceID[0], term);
+ err = __check_input_term(state, d->baSourceID[0], term);
if (err < 0)
return err;
term->type = d->bDescriptorSubtype << 16; /* virtual type */
@@ -811,6 +821,15 @@ static int check_input_term(struct mixer_build *state, int id,
return -ENODEV;
}
+
+static int check_input_term(struct mixer_build *state, int id,
+ struct usb_audio_term *term)
+{
+ memset(term, 0, sizeof(*term));
+ memset(state->termbitmap, 0, sizeof(state->termbitmap));
+ return __check_input_term(state, id, term);
+}
+
/*
* Feature Unit
*/
--
2.17.1
^ permalink raw reply related [flat|nested] 9+ messages in thread* [alsa-devel] [PATCH 2/2] Fix a stack buffer overflow bug in check_input_term 2019-08-30 21:47 [PATCH 2/2] Fix a stack buffer overflow bug in check_input_term Hui Peng @ 2019-08-30 21:47 ` Hui Peng 2019-08-30 21:51 ` Hui Peng 2019-09-01 13:00 ` Salvatore Bonaccorso 2 siblings, 0 replies; 9+ messages in thread From: Hui Peng @ 2019-08-30 21:47 UTC (permalink / raw) To: stable Cc: Mathias Payer, alsa-devel, Greg Kroah-Hartman, Wenwen Wang, Takashi Iwai, Hui Peng, linux-kernel `check_input_term` recursively calls itself with input from device side (e.g., uac_input_terminal_descriptor.bCSourceID) as argument (id). In `check_input_term`, if `check_input_term` is called with the same `id` argument as the caller, it triggers endless recursive call, resulting kernel space stack overflow. This patch fixes the bug by adding a bitmap to `struct mixer_build` to keep track of the checked ids and stop the execution if some id has been checked (similar to how parse_audio_unit handles unitid argument). CVE: CVE-2018-15118 Reported-by: Hui Peng <benquike@gmail.com> Reported-by: Mathias Payer <mathias.payer@nebelwelt.net> Signed-off-by: Hui Peng <benquike@gmail.com> --- sound/usb/mixer.c | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-) diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c index 10ddec76f906..e24572fd6e30 100644 --- a/sound/usb/mixer.c +++ b/sound/usb/mixer.c @@ -81,6 +81,7 @@ struct mixer_build { unsigned char *buffer; unsigned int buflen; DECLARE_BITMAP(unitbitmap, MAX_ID_ELEMS); + DECLARE_BITMAP(termbitmap, MAX_ID_ELEMS); struct usb_audio_term oterm; const struct usbmix_name_map *map; const struct usbmix_selector_map *selector_map; @@ -709,15 +710,24 @@ static int get_term_name(struct mixer_build *state, struct usb_audio_term *iterm * parse the source unit recursively until it reaches to a terminal * or a branched unit. */ -static int check_input_term(struct mixer_build *state, int id, +static int __check_input_term(struct mixer_build *state, int id, struct usb_audio_term *term) { int err; void *p1; + unsigned char *hdr; memset(term, 0, sizeof(*term)); - while ((p1 = find_audio_control_unit(state, id)) != NULL) { - unsigned char *hdr = p1; + for (;;) { + /* a loop in the terminal chain? */ + if (test_and_set_bit(id, state->termbitmap)) + return -EINVAL; + + p1 = find_audio_control_unit(state, id); + if (!p1) + break; + + hdr = p1; term->id = id; switch (hdr[2]) { case UAC_INPUT_TERMINAL: @@ -732,7 +742,7 @@ static int check_input_term(struct mixer_build *state, int id, /* call recursively to verify that the * referenced clock entity is valid */ - err = check_input_term(state, d->bCSourceID, term); + err = __check_input_term(state, d->bCSourceID, term); if (err < 0) return err; @@ -764,7 +774,7 @@ static int check_input_term(struct mixer_build *state, int id, case UAC2_CLOCK_SELECTOR: { struct uac_selector_unit_descriptor *d = p1; /* call recursively to retrieve the channel info */ - err = check_input_term(state, d->baSourceID[0], term); + err = __check_input_term(state, d->baSourceID[0], term); if (err < 0) return err; term->type = d->bDescriptorSubtype << 16; /* virtual type */ @@ -811,6 +821,15 @@ static int check_input_term(struct mixer_build *state, int id, return -ENODEV; } + +static int check_input_term(struct mixer_build *state, int id, + struct usb_audio_term *term) +{ + memset(term, 0, sizeof(*term)); + memset(state->termbitmap, 0, sizeof(state->termbitmap)); + return __check_input_term(state, id, term); +} + /* * Feature Unit */ -- 2.17.1 _______________________________________________ Alsa-devel mailing list Alsa-devel@alsa-project.org https://mailman.alsa-project.org/mailman/listinfo/alsa-devel ^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [PATCH 2/2] Fix a stack buffer overflow bug in check_input_term 2019-08-30 21:47 [PATCH 2/2] Fix a stack buffer overflow bug in check_input_term Hui Peng 2019-08-30 21:47 ` [alsa-devel] " Hui Peng @ 2019-08-30 21:51 ` Hui Peng 2019-08-30 21:51 ` [alsa-devel] " Hui Peng 2019-09-02 16:00 ` Greg Kroah-Hartman 2019-09-01 13:00 ` Salvatore Bonaccorso 2 siblings, 2 replies; 9+ messages in thread From: Hui Peng @ 2019-08-30 21:51 UTC (permalink / raw) To: stable Cc: Mathias Payer, alsa-devel, Greg Kroah-Hartman, Wenwen Wang, Takashi Iwai, linux-kernel This is the backported patch for the following fix to v4.4.x and v4.14.x: 19bce474c45b ("ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term") On Fri, Aug 30, 2019 at 5:47 PM Hui Peng <benquike@gmail.com> wrote: > `check_input_term` recursively calls itself with input from > device side (e.g., uac_input_terminal_descriptor.bCSourceID) > as argument (id). In `check_input_term`, if `check_input_term` > is called with the same `id` argument as the caller, it triggers > endless recursive call, resulting kernel space stack overflow. > > This patch fixes the bug by adding a bitmap to `struct mixer_build` > to keep track of the checked ids and stop the execution if some id > has been checked (similar to how parse_audio_unit handles unitid > argument). > > CVE: CVE-2018-15118 > > Reported-by: Hui Peng <benquike@gmail.com> > Reported-by: Mathias Payer <mathias.payer@nebelwelt.net> > Signed-off-by: Hui Peng <benquike@gmail.com> > --- > sound/usb/mixer.c | 29 ++++++++++++++++++++++++----- > 1 file changed, 24 insertions(+), 5 deletions(-) > > diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c > index 10ddec76f906..e24572fd6e30 100644 > --- a/sound/usb/mixer.c > +++ b/sound/usb/mixer.c > @@ -81,6 +81,7 @@ struct mixer_build { > unsigned char *buffer; > unsigned int buflen; > DECLARE_BITMAP(unitbitmap, MAX_ID_ELEMS); > + DECLARE_BITMAP(termbitmap, MAX_ID_ELEMS); > struct usb_audio_term oterm; > const struct usbmix_name_map *map; > const struct usbmix_selector_map *selector_map; > @@ -709,15 +710,24 @@ static int get_term_name(struct mixer_build *state, > struct usb_audio_term *iterm > * parse the source unit recursively until it reaches to a terminal > * or a branched unit. > */ > -static int check_input_term(struct mixer_build *state, int id, > +static int __check_input_term(struct mixer_build *state, int id, > struct usb_audio_term *term) > { > int err; > void *p1; > + unsigned char *hdr; > > memset(term, 0, sizeof(*term)); > - while ((p1 = find_audio_control_unit(state, id)) != NULL) { > - unsigned char *hdr = p1; > + for (;;) { > + /* a loop in the terminal chain? */ > + if (test_and_set_bit(id, state->termbitmap)) > + return -EINVAL; > + > + p1 = find_audio_control_unit(state, id); > + if (!p1) > + break; > + > + hdr = p1; > term->id = id; > switch (hdr[2]) { > case UAC_INPUT_TERMINAL: > @@ -732,7 +742,7 @@ static int check_input_term(struct mixer_build *state, > int id, > > /* call recursively to verify that the > * referenced clock entity is valid */ > - err = check_input_term(state, > d->bCSourceID, term); > + err = __check_input_term(state, > d->bCSourceID, term); > if (err < 0) > return err; > > @@ -764,7 +774,7 @@ static int check_input_term(struct mixer_build *state, > int id, > case UAC2_CLOCK_SELECTOR: { > struct uac_selector_unit_descriptor *d = p1; > /* call recursively to retrieve the channel info */ > - err = check_input_term(state, d->baSourceID[0], > term); > + err = __check_input_term(state, d->baSourceID[0], > term); > if (err < 0) > return err; > term->type = d->bDescriptorSubtype << 16; /* > virtual type */ > @@ -811,6 +821,15 @@ static int check_input_term(struct mixer_build > *state, int id, > return -ENODEV; > } > > + > +static int check_input_term(struct mixer_build *state, int id, > + struct usb_audio_term *term) > +{ > + memset(term, 0, sizeof(*term)); > + memset(state->termbitmap, 0, sizeof(state->termbitmap)); > + return __check_input_term(state, id, term); > +} > + > /* > * Feature Unit > */ > -- > 2.17.1 > > ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [alsa-devel] [PATCH 2/2] Fix a stack buffer overflow bug in check_input_term 2019-08-30 21:51 ` Hui Peng @ 2019-08-30 21:51 ` Hui Peng 2019-09-02 16:00 ` Greg Kroah-Hartman 1 sibling, 0 replies; 9+ messages in thread From: Hui Peng @ 2019-08-30 21:51 UTC (permalink / raw) To: stable Cc: Mathias Payer, alsa-devel, Greg Kroah-Hartman, Wenwen Wang, Takashi Iwai, linux-kernel This is the backported patch for the following fix to v4.4.x and v4.14.x: 19bce474c45b ("ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term") On Fri, Aug 30, 2019 at 5:47 PM Hui Peng <benquike@gmail.com> wrote: > `check_input_term` recursively calls itself with input from > device side (e.g., uac_input_terminal_descriptor.bCSourceID) > as argument (id). In `check_input_term`, if `check_input_term` > is called with the same `id` argument as the caller, it triggers > endless recursive call, resulting kernel space stack overflow. > > This patch fixes the bug by adding a bitmap to `struct mixer_build` > to keep track of the checked ids and stop the execution if some id > has been checked (similar to how parse_audio_unit handles unitid > argument). > > CVE: CVE-2018-15118 > > Reported-by: Hui Peng <benquike@gmail.com> > Reported-by: Mathias Payer <mathias.payer@nebelwelt.net> > Signed-off-by: Hui Peng <benquike@gmail.com> > --- > sound/usb/mixer.c | 29 ++++++++++++++++++++++++----- > 1 file changed, 24 insertions(+), 5 deletions(-) > > diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c > index 10ddec76f906..e24572fd6e30 100644 > --- a/sound/usb/mixer.c > +++ b/sound/usb/mixer.c > @@ -81,6 +81,7 @@ struct mixer_build { > unsigned char *buffer; > unsigned int buflen; > DECLARE_BITMAP(unitbitmap, MAX_ID_ELEMS); > + DECLARE_BITMAP(termbitmap, MAX_ID_ELEMS); > struct usb_audio_term oterm; > const struct usbmix_name_map *map; > const struct usbmix_selector_map *selector_map; > @@ -709,15 +710,24 @@ static int get_term_name(struct mixer_build *state, > struct usb_audio_term *iterm > * parse the source unit recursively until it reaches to a terminal > * or a branched unit. > */ > -static int check_input_term(struct mixer_build *state, int id, > +static int __check_input_term(struct mixer_build *state, int id, > struct usb_audio_term *term) > { > int err; > void *p1; > + unsigned char *hdr; > > memset(term, 0, sizeof(*term)); > - while ((p1 = find_audio_control_unit(state, id)) != NULL) { > - unsigned char *hdr = p1; > + for (;;) { > + /* a loop in the terminal chain? */ > + if (test_and_set_bit(id, state->termbitmap)) > + return -EINVAL; > + > + p1 = find_audio_control_unit(state, id); > + if (!p1) > + break; > + > + hdr = p1; > term->id = id; > switch (hdr[2]) { > case UAC_INPUT_TERMINAL: > @@ -732,7 +742,7 @@ static int check_input_term(struct mixer_build *state, > int id, > > /* call recursively to verify that the > * referenced clock entity is valid */ > - err = check_input_term(state, > d->bCSourceID, term); > + err = __check_input_term(state, > d->bCSourceID, term); > if (err < 0) > return err; > > @@ -764,7 +774,7 @@ static int check_input_term(struct mixer_build *state, > int id, > case UAC2_CLOCK_SELECTOR: { > struct uac_selector_unit_descriptor *d = p1; > /* call recursively to retrieve the channel info */ > - err = check_input_term(state, d->baSourceID[0], > term); > + err = __check_input_term(state, d->baSourceID[0], > term); > if (err < 0) > return err; > term->type = d->bDescriptorSubtype << 16; /* > virtual type */ > @@ -811,6 +821,15 @@ static int check_input_term(struct mixer_build > *state, int id, > return -ENODEV; > } > > + > +static int check_input_term(struct mixer_build *state, int id, > + struct usb_audio_term *term) > +{ > + memset(term, 0, sizeof(*term)); > + memset(state->termbitmap, 0, sizeof(state->termbitmap)); > + return __check_input_term(state, id, term); > +} > + > /* > * Feature Unit > */ > -- > 2.17.1 > > _______________________________________________ Alsa-devel mailing list Alsa-devel@alsa-project.org https://mailman.alsa-project.org/mailman/listinfo/alsa-devel ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [alsa-devel] [PATCH 2/2] Fix a stack buffer overflow bug in check_input_term 2019-08-30 21:51 ` Hui Peng 2019-08-30 21:51 ` [alsa-devel] " Hui Peng @ 2019-09-02 16:00 ` Greg Kroah-Hartman 1 sibling, 0 replies; 9+ messages in thread From: Greg Kroah-Hartman @ 2019-09-02 16:00 UTC (permalink / raw) To: Hui Peng Cc: alsa-devel, linux-kernel, Wenwen Wang, Mathias Payer, stable, Takashi Iwai On Fri, Aug 30, 2019 at 05:51:17PM -0400, Hui Peng wrote: > This is the backported patch for the following fix to v4.4.x and v4.14.x: > 19bce474c45b ("ALSA: usb-audio: Fix a stack buffer overflow bug in > check_input_term") Now queued up, thanks. greg k-h _______________________________________________ Alsa-devel mailing list Alsa-devel@alsa-project.org https://mailman.alsa-project.org/mailman/listinfo/alsa-devel ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 2/2] Fix a stack buffer overflow bug in check_input_term 2019-08-30 21:47 [PATCH 2/2] Fix a stack buffer overflow bug in check_input_term Hui Peng 2019-08-30 21:47 ` [alsa-devel] " Hui Peng 2019-08-30 21:51 ` Hui Peng @ 2019-09-01 13:00 ` Salvatore Bonaccorso 2019-09-01 13:00 ` [alsa-devel] " Salvatore Bonaccorso 2019-09-01 19:47 ` Hui Peng 2 siblings, 2 replies; 9+ messages in thread From: Salvatore Bonaccorso @ 2019-09-01 13:00 UTC (permalink / raw) To: Hui Peng Cc: stable, Mathias Payer, Jaroslav Kysela, Takashi Iwai, Greg Kroah-Hartman, Wenwen Wang, alsa-devel, linux-kernel Hi Hui, On Fri, Aug 30, 2019 at 05:47:29PM -0400, Hui Peng wrote: > `check_input_term` recursively calls itself with input from > device side (e.g., uac_input_terminal_descriptor.bCSourceID) > as argument (id). In `check_input_term`, if `check_input_term` > is called with the same `id` argument as the caller, it triggers > endless recursive call, resulting kernel space stack overflow. > > This patch fixes the bug by adding a bitmap to `struct mixer_build` > to keep track of the checked ids and stop the execution if some id > has been checked (similar to how parse_audio_unit handles unitid > argument). > > CVE: CVE-2018-15118 Similar to the previous one, this should be CVE-2019-15118 as far I can tell. Regards, Salvatore ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [alsa-devel] [PATCH 2/2] Fix a stack buffer overflow bug in check_input_term 2019-09-01 13:00 ` Salvatore Bonaccorso @ 2019-09-01 13:00 ` Salvatore Bonaccorso 2019-09-01 19:47 ` Hui Peng 1 sibling, 0 replies; 9+ messages in thread From: Salvatore Bonaccorso @ 2019-09-01 13:00 UTC (permalink / raw) To: Hui Peng Cc: Mathias Payer, alsa-devel, Greg Kroah-Hartman, Wenwen Wang, Takashi Iwai, stable, linux-kernel Hi Hui, On Fri, Aug 30, 2019 at 05:47:29PM -0400, Hui Peng wrote: > `check_input_term` recursively calls itself with input from > device side (e.g., uac_input_terminal_descriptor.bCSourceID) > as argument (id). In `check_input_term`, if `check_input_term` > is called with the same `id` argument as the caller, it triggers > endless recursive call, resulting kernel space stack overflow. > > This patch fixes the bug by adding a bitmap to `struct mixer_build` > to keep track of the checked ids and stop the execution if some id > has been checked (similar to how parse_audio_unit handles unitid > argument). > > CVE: CVE-2018-15118 Similar to the previous one, this should be CVE-2019-15118 as far I can tell. Regards, Salvatore _______________________________________________ Alsa-devel mailing list Alsa-devel@alsa-project.org https://mailman.alsa-project.org/mailman/listinfo/alsa-devel ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 2/2] Fix a stack buffer overflow bug in check_input_term 2019-09-01 13:00 ` Salvatore Bonaccorso 2019-09-01 13:00 ` [alsa-devel] " Salvatore Bonaccorso @ 2019-09-01 19:47 ` Hui Peng 2019-09-01 19:47 ` [alsa-devel] " Hui Peng 1 sibling, 1 reply; 9+ messages in thread From: Hui Peng @ 2019-09-01 19:47 UTC (permalink / raw) To: carnil Cc: stable, mathias.payer, perex, tiwai, gregkh, wang6495, alsa-devel, linux-kernel [-- Attachment #1: Type: text/plain, Size: 891 bytes --] On 9/1/19 9:00 AM, Salvatore Bonaccorso wrote: > Hi Hui, > > On Fri, Aug 30, 2019 at 05:47:29PM -0400, Hui Peng wrote: >> `check_input_term` recursively calls itself with input from >> device side (e.g., uac_input_terminal_descriptor.bCSourceID) >> as argument (id). In `check_input_term`, if `check_input_term` >> is called with the same `id` argument as the caller, it triggers >> endless recursive call, resulting kernel space stack overflow. >> >> This patch fixes the bug by adding a bitmap to `struct mixer_build` >> to keep track of the checked ids and stop the execution if some id >> has been checked (similar to how parse_audio_unit handles unitid >> argument). >> >> CVE: CVE-2018-15118 > Similar to the previous one, this should be CVE-2019-15118 as far I > can tell. Same here: CVE id updated. Can you apply it to v4.4.190 and v4.14.141? Thanks. > > Regards, > Salvatore [-- Attachment #2: 0002-Fix-a-stack-buffer-overflow-bug-in-check_input_term.patch --] [-- Type: text/x-patch, Size: 3425 bytes --] >From f5e478c4807b16f49c00316fb80485562b84340a Mon Sep 17 00:00:00 2001 From: Hui Peng <benquike@gmail.com> Date: Fri, 30 Aug 2019 16:20:41 -0400 Subject: [PATCH 2/2] Fix a stack buffer overflow bug in check_input_term `check_input_term` recursively calls itself with input from device side (e.g., uac_input_terminal_descriptor.bCSourceID) as argument (id). In `check_input_term`, if `check_input_term` is called with the same `id` argument as the caller, it triggers endless recursive call, resulting kernel space stack overflow. This patch fixes the bug by adding a bitmap to `struct mixer_build` to keep track of the checked ids and stop the execution if some id has been checked (similar to how parse_audio_unit handles unitid argument). CVE: CVE-2019-15118 Reported-by: Hui Peng <benquike@gmail.com> Reported-by: Mathias Payer <mathias.payer@nebelwelt.net> Signed-off-by: Hui Peng <benquike@gmail.com> --- sound/usb/mixer.c | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-) diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c index 10ddec76f906..e24572fd6e30 100644 --- a/sound/usb/mixer.c +++ b/sound/usb/mixer.c @@ -81,6 +81,7 @@ struct mixer_build { unsigned char *buffer; unsigned int buflen; DECLARE_BITMAP(unitbitmap, MAX_ID_ELEMS); + DECLARE_BITMAP(termbitmap, MAX_ID_ELEMS); struct usb_audio_term oterm; const struct usbmix_name_map *map; const struct usbmix_selector_map *selector_map; @@ -709,15 +710,24 @@ static int get_term_name(struct mixer_build *state, struct usb_audio_term *iterm * parse the source unit recursively until it reaches to a terminal * or a branched unit. */ -static int check_input_term(struct mixer_build *state, int id, +static int __check_input_term(struct mixer_build *state, int id, struct usb_audio_term *term) { int err; void *p1; + unsigned char *hdr; memset(term, 0, sizeof(*term)); - while ((p1 = find_audio_control_unit(state, id)) != NULL) { - unsigned char *hdr = p1; + for (;;) { + /* a loop in the terminal chain? */ + if (test_and_set_bit(id, state->termbitmap)) + return -EINVAL; + + p1 = find_audio_control_unit(state, id); + if (!p1) + break; + + hdr = p1; term->id = id; switch (hdr[2]) { case UAC_INPUT_TERMINAL: @@ -732,7 +742,7 @@ static int check_input_term(struct mixer_build *state, int id, /* call recursively to verify that the * referenced clock entity is valid */ - err = check_input_term(state, d->bCSourceID, term); + err = __check_input_term(state, d->bCSourceID, term); if (err < 0) return err; @@ -764,7 +774,7 @@ static int check_input_term(struct mixer_build *state, int id, case UAC2_CLOCK_SELECTOR: { struct uac_selector_unit_descriptor *d = p1; /* call recursively to retrieve the channel info */ - err = check_input_term(state, d->baSourceID[0], term); + err = __check_input_term(state, d->baSourceID[0], term); if (err < 0) return err; term->type = d->bDescriptorSubtype << 16; /* virtual type */ @@ -811,6 +821,15 @@ static int check_input_term(struct mixer_build *state, int id, return -ENODEV; } + +static int check_input_term(struct mixer_build *state, int id, + struct usb_audio_term *term) +{ + memset(term, 0, sizeof(*term)); + memset(state->termbitmap, 0, sizeof(state->termbitmap)); + return __check_input_term(state, id, term); +} + /* * Feature Unit */ -- 2.17.1 ^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [alsa-devel] [PATCH 2/2] Fix a stack buffer overflow bug in check_input_term 2019-09-01 19:47 ` Hui Peng @ 2019-09-01 19:47 ` Hui Peng 0 siblings, 0 replies; 9+ messages in thread From: Hui Peng @ 2019-09-01 19:47 UTC (permalink / raw) To: carnil Cc: mathias.payer, alsa-devel, gregkh, wang6495, tiwai, stable, linux-kernel [-- Attachment #1: Type: text/plain, Size: 891 bytes --] On 9/1/19 9:00 AM, Salvatore Bonaccorso wrote: > Hi Hui, > > On Fri, Aug 30, 2019 at 05:47:29PM -0400, Hui Peng wrote: >> `check_input_term` recursively calls itself with input from >> device side (e.g., uac_input_terminal_descriptor.bCSourceID) >> as argument (id). In `check_input_term`, if `check_input_term` >> is called with the same `id` argument as the caller, it triggers >> endless recursive call, resulting kernel space stack overflow. >> >> This patch fixes the bug by adding a bitmap to `struct mixer_build` >> to keep track of the checked ids and stop the execution if some id >> has been checked (similar to how parse_audio_unit handles unitid >> argument). >> >> CVE: CVE-2018-15118 > Similar to the previous one, this should be CVE-2019-15118 as far I > can tell. Same here: CVE id updated. Can you apply it to v4.4.190 and v4.14.141? Thanks. > > Regards, > Salvatore [-- Attachment #2: 0002-Fix-a-stack-buffer-overflow-bug-in-check_input_term.patch --] [-- Type: text/x-patch, Size: 3424 bytes --] From f5e478c4807b16f49c00316fb80485562b84340a Mon Sep 17 00:00:00 2001 From: Hui Peng <benquike@gmail.com> Date: Fri, 30 Aug 2019 16:20:41 -0400 Subject: [PATCH 2/2] Fix a stack buffer overflow bug in check_input_term `check_input_term` recursively calls itself with input from device side (e.g., uac_input_terminal_descriptor.bCSourceID) as argument (id). In `check_input_term`, if `check_input_term` is called with the same `id` argument as the caller, it triggers endless recursive call, resulting kernel space stack overflow. This patch fixes the bug by adding a bitmap to `struct mixer_build` to keep track of the checked ids and stop the execution if some id has been checked (similar to how parse_audio_unit handles unitid argument). CVE: CVE-2019-15118 Reported-by: Hui Peng <benquike@gmail.com> Reported-by: Mathias Payer <mathias.payer@nebelwelt.net> Signed-off-by: Hui Peng <benquike@gmail.com> --- sound/usb/mixer.c | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-) diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c index 10ddec76f906..e24572fd6e30 100644 --- a/sound/usb/mixer.c +++ b/sound/usb/mixer.c @@ -81,6 +81,7 @@ struct mixer_build { unsigned char *buffer; unsigned int buflen; DECLARE_BITMAP(unitbitmap, MAX_ID_ELEMS); + DECLARE_BITMAP(termbitmap, MAX_ID_ELEMS); struct usb_audio_term oterm; const struct usbmix_name_map *map; const struct usbmix_selector_map *selector_map; @@ -709,15 +710,24 @@ static int get_term_name(struct mixer_build *state, struct usb_audio_term *iterm * parse the source unit recursively until it reaches to a terminal * or a branched unit. */ -static int check_input_term(struct mixer_build *state, int id, +static int __check_input_term(struct mixer_build *state, int id, struct usb_audio_term *term) { int err; void *p1; + unsigned char *hdr; memset(term, 0, sizeof(*term)); - while ((p1 = find_audio_control_unit(state, id)) != NULL) { - unsigned char *hdr = p1; + for (;;) { + /* a loop in the terminal chain? */ + if (test_and_set_bit(id, state->termbitmap)) + return -EINVAL; + + p1 = find_audio_control_unit(state, id); + if (!p1) + break; + + hdr = p1; term->id = id; switch (hdr[2]) { case UAC_INPUT_TERMINAL: @@ -732,7 +742,7 @@ static int check_input_term(struct mixer_build *state, int id, /* call recursively to verify that the * referenced clock entity is valid */ - err = check_input_term(state, d->bCSourceID, term); + err = __check_input_term(state, d->bCSourceID, term); if (err < 0) return err; @@ -764,7 +774,7 @@ static int check_input_term(struct mixer_build *state, int id, case UAC2_CLOCK_SELECTOR: { struct uac_selector_unit_descriptor *d = p1; /* call recursively to retrieve the channel info */ - err = check_input_term(state, d->baSourceID[0], term); + err = __check_input_term(state, d->baSourceID[0], term); if (err < 0) return err; term->type = d->bDescriptorSubtype << 16; /* virtual type */ @@ -811,6 +821,15 @@ static int check_input_term(struct mixer_build *state, int id, return -ENODEV; } + +static int check_input_term(struct mixer_build *state, int id, + struct usb_audio_term *term) +{ + memset(term, 0, sizeof(*term)); + memset(state->termbitmap, 0, sizeof(state->termbitmap)); + return __check_input_term(state, id, term); +} + /* * Feature Unit */ -- 2.17.1 [-- Attachment #3: Type: text/plain, Size: 161 bytes --] _______________________________________________ Alsa-devel mailing list Alsa-devel@alsa-project.org https://mailman.alsa-project.org/mailman/listinfo/alsa-devel ^ permalink raw reply related [flat|nested] 9+ messages in thread
end of thread, other threads:[~2019-09-02 16:02 UTC | newest] Thread overview: 9+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2019-08-30 21:47 [PATCH 2/2] Fix a stack buffer overflow bug in check_input_term Hui Peng 2019-08-30 21:47 ` [alsa-devel] " Hui Peng 2019-08-30 21:51 ` Hui Peng 2019-08-30 21:51 ` [alsa-devel] " Hui Peng 2019-09-02 16:00 ` Greg Kroah-Hartman 2019-09-01 13:00 ` Salvatore Bonaccorso 2019-09-01 13:00 ` [alsa-devel] " Salvatore Bonaccorso 2019-09-01 19:47 ` Hui Peng 2019-09-01 19:47 ` [alsa-devel] " Hui Peng
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox