* [PATCH] Fix shift-out-of-bound in mceusb_process_ir_data
@ 2021-01-13 11:11 Dongliang Mu
2021-01-13 14:27 ` Sean Young
0 siblings, 1 reply; 3+ messages in thread
From: Dongliang Mu @ 2021-01-13 11:11 UTC (permalink / raw)
To: mchehab, linux-media, linux-kernel, mudongliangabcd
The missing check of ir->buf_in[i+1] can lead to an shift-out-of-bound
in mceusb_handle_command or mceusb_dev_printdata. This patch adds a
check to limit its value lower than 16. The concrete report of UBSAN is
as follows.
UBSAN: shift-out-of-bounds in drivers/media/rc/mceusb.c:704:13
shift exponent 230 is too large for 32-bit type 'unsigned int'
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.10.0-syzkaller #0
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:79 [inline]
dump_stack+0x107/0x163 lib/dump_stack.c:120
ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
__ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395
mceusb_dev_printdata.cold+0x19/0x1e drivers/media/rc/mceusb.c:704
mceusb_process_ir_data drivers/media/rc/mceusb.c:1275 [inline]
mceusb_dev_recv+0x3cb/0x1990 drivers/media/rc/mceusb.c:1376
__usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1657
usb_hcd_giveback_urb+0x38c/0x430 drivers/usb/core/hcd.c:1728
dummy_timer+0x11f4/0x32a0 drivers/usb/gadget/udc/dummy_hcd.c:1971
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
---
drivers/media/rc/mceusb.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c
index f9616158bcf4..755808c6e747 100644
--- a/drivers/media/rc/mceusb.c
+++ b/drivers/media/rc/mceusb.c
@@ -1272,6 +1272,8 @@ static void mceusb_process_ir_data(struct mceusb_dev *ir, int buf_len)
switch (ir->parser_state) {
case SUBCMD:
ir->rem = mceusb_cmd_datasize(ir->cmd, ir->buf_in[i]);
+ if (ir->buf_in[i+1] >= 16)
+ continue;
mceusb_dev_printdata(ir, ir->buf_in, buf_len, i - 1,
ir->rem + 2, false);
if (i + ir->rem < buf_len)
--
2.25.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] Fix shift-out-of-bound in mceusb_process_ir_data
2021-01-13 11:11 [PATCH] Fix shift-out-of-bound in mceusb_process_ir_data Dongliang Mu
@ 2021-01-13 14:27 ` Sean Young
2021-01-14 3:03 ` 慕冬亮
0 siblings, 1 reply; 3+ messages in thread
From: Sean Young @ 2021-01-13 14:27 UTC (permalink / raw)
To: Dongliang Mu; +Cc: mchehab, linux-media, linux-kernel
On Wed, Jan 13, 2021 at 07:11:22PM +0800, Dongliang Mu wrote:
> The missing check of ir->buf_in[i+1] can lead to an shift-out-of-bound
> in mceusb_handle_command or mceusb_dev_printdata. This patch adds a
> check to limit its value lower than 16. The concrete report of UBSAN is
> as follows.
>
> UBSAN: shift-out-of-bounds in drivers/media/rc/mceusb.c:704:13
> shift exponent 230 is too large for 32-bit type 'unsigned int'
> CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.10.0-syzkaller #0
> Call Trace:
> <IRQ>
> __dump_stack lib/dump_stack.c:79 [inline]
> dump_stack+0x107/0x163 lib/dump_stack.c:120
> ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
> __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395
> mceusb_dev_printdata.cold+0x19/0x1e drivers/media/rc/mceusb.c:704
> mceusb_process_ir_data drivers/media/rc/mceusb.c:1275 [inline]
> mceusb_dev_recv+0x3cb/0x1990 drivers/media/rc/mceusb.c:1376
> __usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1657
> usb_hcd_giveback_urb+0x38c/0x430 drivers/usb/core/hcd.c:1728
> dummy_timer+0x11f4/0x32a0 drivers/usb/gadget/udc/dummy_hcd.c:1971
>
> Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
> ---
> drivers/media/rc/mceusb.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c
> index f9616158bcf4..755808c6e747 100644
> --- a/drivers/media/rc/mceusb.c
> +++ b/drivers/media/rc/mceusb.c
> @@ -1272,6 +1272,8 @@ static void mceusb_process_ir_data(struct mceusb_dev *ir, int buf_len)
> switch (ir->parser_state) {
> case SUBCMD:
> ir->rem = mceusb_cmd_datasize(ir->cmd, ir->buf_in[i]);
> + if (ir->buf_in[i+1] >= 16)
> + continue;
I'm not sure this is correct. This checks the second byte for *any* response,
not just MCE_RSP_EQIRCFS response which is causing the "shift out of bounds"
issue.
I think the check belongs within the MCE_RSP_EQIRCFS case.
Lastly it should have been break, not continue.
Thanks
Sean
> mceusb_dev_printdata(ir, ir->buf_in, buf_len, i - 1,
> ir->rem + 2, false);
> if (i + ir->rem < buf_len)
> --
> 2.25.1
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] Fix shift-out-of-bound in mceusb_process_ir_data
2021-01-13 14:27 ` Sean Young
@ 2021-01-14 3:03 ` 慕冬亮
0 siblings, 0 replies; 3+ messages in thread
From: 慕冬亮 @ 2021-01-14 3:03 UTC (permalink / raw)
To: Sean Young; +Cc: mchehab, linux-media, linux-kernel
On Wed, Jan 13, 2021 at 10:27 PM Sean Young <sean@mess.org> wrote:
>
> On Wed, Jan 13, 2021 at 07:11:22PM +0800, Dongliang Mu wrote:
> > The missing check of ir->buf_in[i+1] can lead to an shift-out-of-bound
> > in mceusb_handle_command or mceusb_dev_printdata. This patch adds a
> > check to limit its value lower than 16. The concrete report of UBSAN is
> > as follows.
> >
> > UBSAN: shift-out-of-bounds in drivers/media/rc/mceusb.c:704:13
> > shift exponent 230 is too large for 32-bit type 'unsigned int'
> > CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.10.0-syzkaller #0
> > Call Trace:
> > <IRQ>
> > __dump_stack lib/dump_stack.c:79 [inline]
> > dump_stack+0x107/0x163 lib/dump_stack.c:120
> > ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
> > __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395
> > mceusb_dev_printdata.cold+0x19/0x1e drivers/media/rc/mceusb.c:704
> > mceusb_process_ir_data drivers/media/rc/mceusb.c:1275 [inline]
> > mceusb_dev_recv+0x3cb/0x1990 drivers/media/rc/mceusb.c:1376
> > __usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1657
> > usb_hcd_giveback_urb+0x38c/0x430 drivers/usb/core/hcd.c:1728
> > dummy_timer+0x11f4/0x32a0 drivers/usb/gadget/udc/dummy_hcd.c:1971
> >
> > Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
> > ---
> > drivers/media/rc/mceusb.c | 2 ++
> > 1 file changed, 2 insertions(+)
> >
> > diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c
> > index f9616158bcf4..755808c6e747 100644
> > --- a/drivers/media/rc/mceusb.c
> > +++ b/drivers/media/rc/mceusb.c
> > @@ -1272,6 +1272,8 @@ static void mceusb_process_ir_data(struct mceusb_dev *ir, int buf_len)
> > switch (ir->parser_state) {
> > case SUBCMD:
> > ir->rem = mceusb_cmd_datasize(ir->cmd, ir->buf_in[i]);
> > + if (ir->buf_in[i+1] >= 16)
> > + continue;
>
> I'm not sure this is correct. This checks the second byte for *any* response,
> not just MCE_RSP_EQIRCFS response which is causing the "shift out of bounds"
> issue.
>
I am not familiar with the logic of this driver and the semantics of
ir->buf_in[i+1]. I just added one filter and if it breaks the
condition, then skip the current loop.
> I think the check belongs within the MCE_RSP_EQIRCFS case.
>
> Lastly it should have been break, not continue.
If this error data could affect the following parser_state and makes
it stop in the logic, "break" is better.
>
> Thanks
>
> Sean
>
>
>
> > mceusb_dev_printdata(ir, ir->buf_in, buf_len, i - 1,
> > ir->rem + 2, false);
> > if (i + ir->rem < buf_len)
> > --
> > 2.25.1
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-01-14 3:04 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-01-13 11:11 [PATCH] Fix shift-out-of-bound in mceusb_process_ir_data Dongliang Mu
2021-01-13 14:27 ` Sean Young
2021-01-14 3:03 ` 慕冬亮
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox