linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH v2] media: uvcvideo: Fix OOB read
@ 2023-07-20 17:46 Ricardo Ribalda
  2023-07-20 21:47 ` Sergey Senozhatsky
  2023-07-25 21:34 ` Laurent Pinchart
  0 siblings, 2 replies; 11+ messages in thread
From: Ricardo Ribalda @ 2023-07-20 17:46 UTC (permalink / raw)
  To: Laurent Pinchart, Mauro Carvalho Chehab
  Cc: linux-media, linux-kernel, Sergey Senozhatsky, stable,
	Zubin Mithra, Ricardo Ribalda

If the index provided by the user is bigger than the mask size, we might do an
out of bound read.

CC: stable@kernel.org
Fixes: 40140eda661e ("media: uvcvideo: Implement mask for V4L2_CTRL_TYPE_MENU")
Reported-by: Zubin Mithra <zsm@chromium.org>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
---
Avoid reading index >= 31
---
Changes in v2:
- Use BITS_PER_TYPE instead of 32 (thanks Sergey).
- Add Reported-by tag.
- Link to v1: https://lore.kernel.org/r/20230717-uvc-oob-v1-1-f5b9b4aba3b4@chromium.org
---
 drivers/media/usb/uvc/uvc_ctrl.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
index 5e9d3da862dd..e59a463c2761 100644
--- a/drivers/media/usb/uvc/uvc_ctrl.c
+++ b/drivers/media/usb/uvc/uvc_ctrl.c
@@ -1402,6 +1402,9 @@ int uvc_query_v4l2_menu(struct uvc_video_chain *chain,
 	query_menu->id = id;
 	query_menu->index = index;
 
+	if (index >= BITS_PER_TYPE(mapping->menu_mask))
+		return -EINVAL;
+
 	ret = mutex_lock_interruptible(&chain->ctrl_mutex);
 	if (ret < 0)
 		return -ERESTARTSYS;

---
base-commit: fdf0eaf11452d72945af31804e2a1048ee1b574c
change-id: 20230717-uvc-oob-4b0148a00417

Best regards,
-- 
Ricardo Ribalda <ribalda@chromium.org>


^ permalink raw reply related	[flat|nested] 11+ messages in thread

end of thread, other threads:[~2023-07-26 15:19 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-07-20 17:46 [PATCH v2] media: uvcvideo: Fix OOB read Ricardo Ribalda
2023-07-20 21:47 ` Sergey Senozhatsky
2023-07-25 21:34 ` Laurent Pinchart
2023-07-26  6:24   ` Ricardo Ribalda
2023-07-26  8:07     ` Laurent Pinchart
2023-07-26  8:33       ` Thorsten Leemhuis
2023-07-26  8:38         ` Ricardo Ribalda
2023-07-26  8:47           ` Thorsten Leemhuis
2023-07-26 13:43             ` Zubin Mithra
2023-07-26 15:19             ` Laurent Pinchart
2023-07-26  8:37       ` Ricardo Ribalda

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).