linux-stable.git/drivers/media, branch v4.1.41

xc2028: Fix use-after-free bug properly

2017-06-13T13:29:21+00:00

[ Upstream commit 22a1e7783e173ab3d86018eb590107d68df46c11 ]

The commit 8dfbcc4351a0 ("[media] xc2028: avoid use after free") tried
to address the reported use-after-free by clearing the reference.

However, it's clearing the wrong pointer; it sets NULL to
priv->ctrl.fname, but it's anyway overwritten by the next line
memcpy(&priv->ctrl, p, sizeof(priv->ctrl)).

OTOH, the actual code accessing the freed string is the strcmp() call
with priv->fname:
	if (!firmware_name[0] && p->fname &&
	    priv->fname && strcmp(p->fname, priv->fname))
		free_firmware(priv);

where priv->fname points to the previous file name, and this was
already freed by kfree().

For fixing the bug properly, this patch does the following:

- Keep the copy of firmware file name in only priv->fname,
  priv->ctrl.fname isn't changed;
- The allocation is done only when the firmware gets loaded;
- The kfree() is called in free_firmware() commonly

Fixes: commit 8dfbcc4351a0 ('[media] xc2028: avoid use after free')
Cc: 
Signed-off-by: Takashi Iwai 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

[media] xc2028: unlock on error in xc2028_set_config()

2017-06-13T13:29:18+00:00

[ Upstream commit 210bd104c6acd31c3c6b8b075b3f12d4a9f6b60d ]

We have to unlock before returning -ENOMEM.

Fixes: 8dfbcc4351a0 ('[media] xc2028: avoid use after free')

Signed-off-by: Dan Carpenter 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

[media] xc2028: avoid use after free

2017-06-13T13:29:17+00:00

[ Upstream commit 8dfbcc4351a0b6d2f2d77f367552f48ffefafe18 ]

If struct xc2028_config is passed without a firmware name,
the following trouble may happen:

[11009.907205] xc2028 5-0061: type set to XCeive xc2028/xc3028 tuner
[11009.907491] ==================================================================
[11009.907750] BUG: KASAN: use-after-free in strcmp+0x96/0xb0 at addr ffff8803bd78ab40
[11009.907992] Read of size 1 by task modprobe/28992
[11009.907994] =============================================================================
[11009.907997] BUG kmalloc-16 (Tainted: G        W      ): kasan: bad access detected
[11009.907999] -----------------------------------------------------------------------------

[11009.908008] INFO: Allocated in xhci_urb_enqueue+0x214/0x14c0 [xhci_hcd] age=0 cpu=3 pid=28992
[11009.908012] 	___slab_alloc+0x581/0x5b0
[11009.908014] 	__slab_alloc+0x51/0x90
[11009.908017] 	__kmalloc+0x27b/0x350
[11009.908022] 	xhci_urb_enqueue+0x214/0x14c0 [xhci_hcd]
[11009.908026] 	usb_hcd_submit_urb+0x1e8/0x1c60
[11009.908029] 	usb_submit_urb+0xb0e/0x1200
[11009.908032] 	usb_serial_generic_write_start+0xb6/0x4c0
[11009.908035] 	usb_serial_generic_write+0x92/0xc0
[11009.908039] 	usb_console_write+0x38a/0x560
[11009.908045] 	call_console_drivers.constprop.14+0x1ee/0x2c0
[11009.908051] 	console_unlock+0x40d/0x900
[11009.908056] 	vprintk_emit+0x4b4/0x830
[11009.908061] 	vprintk_default+0x1f/0x30
[11009.908064] 	printk+0x99/0xb5
[11009.908067] 	kasan_report_error+0x10a/0x550
[11009.908070] 	__asan_report_load1_noabort+0x43/0x50
[11009.908074] INFO: Freed in xc2028_set_config+0x90/0x630 [tuner_xc2028] age=1 cpu=3 pid=28992
[11009.908077] 	__slab_free+0x2ec/0x460
[11009.908080] 	kfree+0x266/0x280
[11009.908083] 	xc2028_set_config+0x90/0x630 [tuner_xc2028]
[11009.908086] 	xc2028_attach+0x310/0x8a0 [tuner_xc2028]
[11009.908090] 	em28xx_attach_xc3028.constprop.7+0x1f9/0x30d [em28xx_dvb]
[11009.908094] 	em28xx_dvb_init.part.3+0x8e4/0x5cf4 [em28xx_dvb]
[11009.908098] 	em28xx_dvb_init+0x81/0x8a [em28xx_dvb]
[11009.908101] 	em28xx_register_extension+0xd9/0x190 [em28xx]
[11009.908105] 	em28xx_dvb_register+0x10/0x1000 [em28xx_dvb]
[11009.908108] 	do_one_initcall+0x141/0x300
[11009.908111] 	do_init_module+0x1d0/0x5ad
[11009.908114] 	load_module+0x6666/0x9ba0
[11009.908117] 	SyS_finit_module+0x108/0x130
[11009.908120] 	entry_SYSCALL_64_fastpath+0x16/0x76
[11009.908123] INFO: Slab 0xffffea000ef5e280 objects=25 used=25 fp=0x          (null) flags=0x2ffff8000004080
[11009.908126] INFO: Object 0xffff8803bd78ab40 @offset=2880 fp=0x0000000000000001

[11009.908130] Bytes b4 ffff8803bd78ab30: 01 00 00 00 2a 07 00 00 9d 28 00 00 01 00 00 00  ....*....(......
[11009.908133] Object ffff8803bd78ab40: 01 00 00 00 00 00 00 00 b0 1d c3 6a 00 88 ff ff  ...........j....
[11009.908137] CPU: 3 PID: 28992 Comm: modprobe Tainted: G    B   W       4.5.0-rc1+ #43
[11009.908140] Hardware name:                  /NUC5i7RYB, BIOS RYBDWi35.86A.0350.2015.0812.1722 08/12/2015
[11009.908142]  ffff8803bd78a000 ffff8802c273f1b8 ffffffff81932007 ffff8803c6407a80
[11009.908148]  ffff8802c273f1e8 ffffffff81556759 ffff8803c6407a80 ffffea000ef5e280
[11009.908153]  ffff8803bd78ab40 dffffc0000000000 ffff8802c273f210 ffffffff8155ccb4
[11009.908158] Call Trace:
[11009.908162]  [] dump_stack+0x4b/0x64
[11009.908165]  [] print_trailer+0xf9/0x150
[11009.908168]  [] object_err+0x34/0x40
[11009.908171]  [] kasan_report_error+0x230/0x550
[11009.908175]  [] ? trace_hardirqs_off_caller+0x21/0x290
[11009.908179]  [] ? kasan_unpoison_shadow+0x36/0x50
[11009.908182]  [] __asan_report_load1_noabort+0x43/0x50
[11009.908185]  [] ? __asan_register_globals+0x50/0xa0
[11009.908189]  [] ? strcmp+0x96/0xb0
[11009.908192]  [] strcmp+0x96/0xb0
[11009.908196]  [] xc2028_set_config+0x15c/0x630 [tuner_xc2028]
[11009.908200]  [] xc2028_attach+0x310/0x8a0 [tuner_xc2028]
[11009.908203]  [] ? memset+0x28/0x30
[11009.908206]  [] ? xc2028_set_config+0x630/0x630 [tuner_xc2028]
[11009.908211]  [] em28xx_attach_xc3028.constprop.7+0x1f9/0x30d [em28xx_dvb]
[11009.908215]  [] ? em28xx_dvb_init.part.3+0x37c/0x5cf4 [em28xx_dvb]
[11009.908219]  [] ? hauppauge_hvr930c_init+0x487/0x487 [em28xx_dvb]
[11009.908222]  [] ? lgdt330x_attach+0x1cc/0x370 [lgdt330x]
[11009.908226]  [] ? i2c_read_demod_bytes.isra.2+0x210/0x210 [lgdt330x]
[11009.908230]  [] ? ref_module.part.15+0x10/0x10
[11009.908233]  [] ? module_assert_mutex_or_preempt+0x80/0x80
[11009.908238]  [] em28xx_dvb_init.part.3+0x8e4/0x5cf4 [em28xx_dvb]
[11009.908242]  [] ? em28xx_attach_xc3028.constprop.7+0x30d/0x30d [em28xx_dvb]
[11009.908245]  [] ? string+0x14d/0x1f0
[11009.908249]  [] ? symbol_string+0xff/0x1a0
[11009.908253]  [] ? uuid_string+0x6f0/0x6f0
[11009.908257]  [] ? __kernel_text_address+0x7e/0xa0
[11009.908260]  [] ? print_context_stack+0x7f/0xf0
[11009.908264]  [] ? __module_address+0xb6/0x360
[11009.908268]  [] ? is_ftrace_trampoline+0x99/0xe0
[11009.908271]  [] ? __kernel_text_address+0x7e/0xa0
[11009.908275]  [] ? debug_check_no_locks_freed+0x290/0x290
[11009.908278]  [] ? dump_trace+0x11b/0x300
[11009.908282]  [] ? em28xx_register_extension+0x23/0x190 [em28xx]
[11009.908285]  [] ? trace_hardirqs_off_caller+0x21/0x290
[11009.908289]  [] ? trace_hardirqs_on_caller+0x16/0x590
[11009.908292]  [] ? trace_hardirqs_on+0xd/0x10
[11009.908296]  [] ? em28xx_register_extension+0x23/0x190 [em28xx]
[11009.908299]  [] ? mutex_trylock+0x400/0x400
[11009.908302]  [] ? do_one_initcall+0x131/0x300
[11009.908306]  [] ? call_rcu_sched+0x17/0x20
[11009.908309]  [] ? put_object+0x48/0x70
[11009.908314]  [] em28xx_dvb_init+0x81/0x8a [em28xx_dvb]
[11009.908317]  [] em28xx_register_extension+0xd9/0x190 [em28xx]
[11009.908320]  [] ? 0xffffffffa0150000
[11009.908324]  [] em28xx_dvb_register+0x10/0x1000 [em28xx_dvb]
[11009.908327]  [] do_one_initcall+0x141/0x300
[11009.908330]  [] ? try_to_run_init_process+0x40/0x40
[11009.908333]  [] ? trace_hardirqs_on_caller+0x16/0x590
[11009.908337]  [] ? kasan_unpoison_shadow+0x36/0x50
[11009.908340]  [] ? kasan_unpoison_shadow+0x36/0x50
[11009.908343]  [] ? kasan_unpoison_shadow+0x36/0x50
[11009.908346]  [] ? __asan_register_globals+0x87/0xa0
[11009.908350]  [] do_init_module+0x1d0/0x5ad
[11009.908353]  [] load_module+0x6666/0x9ba0
[11009.908356]  [] ? symbol_put_addr+0x50/0x50
[11009.908361]  [] ? em28xx_dvb_init.part.3+0x5989/0x5cf4 [em28xx_dvb]
[11009.908366]  [] ? module_frob_arch_sections+0x20/0x20
[11009.908369]  [] ? open_exec+0x50/0x50
[11009.908374]  [] ? ns_capable+0x5b/0xd0
[11009.908377]  [] SyS_finit_module+0x108/0x130
[11009.908379]  [] ? SyS_init_module+0x1f0/0x1f0
[11009.908383]  [] ? lockdep_sys_exit_thunk+0x12/0x14
[11009.908394]  [] entry_SYSCALL_64_fastpath+0x16/0x76
[11009.908396] Memory state around the buggy address:
[11009.908398]  ffff8803bd78aa00: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[11009.908401]  ffff8803bd78aa80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[11009.908403] >ffff8803bd78ab00: fc fc fc fc fc fc fc fc 00 00 fc fc fc fc fc fc
[11009.908405]                                            ^
[11009.908407]  ffff8803bd78ab80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[11009.908409]  ffff8803bd78ac00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[11009.908411] ==================================================================

In order to avoid it, let's set the cached value of the firmware
name to NULL after freeing it. While here, return an error if
the memory allocation fails.

Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

[media] dvb-usb-v2: avoid use-after-free

2017-06-13T13:29:16+00:00

[ Upstream commit 005145378c9ad7575a01b6ce1ba118fb427f583a ]

I ran into a stack frame size warning because of the on-stack copy of
the USB device structure:

drivers/media/usb/dvb-usb-v2/dvb_usb_core.c: In function 'dvb_usbv2_disconnect':
drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:1029:1: error: the frame size of 1104 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]

Copying a device structure like this is wrong for a number of other reasons
too aside from the possible stack overflow. One of them is that the
dev_info() call will print the name of the device later, but AFAICT
we have only copied a pointer to the name earlier and the actual name
has been freed by the time it gets printed.

This removes the on-stack copy of the device and instead copies the
device name using kstrdup(). I'm ignoring the possible failure here
as both printk() and kfree() are able to deal with NULL pointers.

Signed-off-by: Arnd Bergmann 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

[media] ttusb2: limit messages to buffer size

2017-05-17T19:08:23+00:00

[ Upstream commit a12b8ab8c5ff7ccd7b107a564743507c850a441d ]

Otherwise ttusb2_i2c_xfer can read or write beyond the end of static and
heap buffers.

Signed-off-by: Alyssa Milburn 
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

[media] zr364xx: enforce minimum size when reading header

2017-05-17T19:08:23+00:00

[ Upstream commit ee0fe833d96793853335844b6d99fb76bd12cbeb ]

This code copies actual_length-128 bytes from the header, which will
underflow if the received buffer is too small.

Signed-off-by: Alyssa Milburn 
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

[media] cx231xx-audio: fix NULL-deref at probe

2017-05-17T19:08:22+00:00

[ Upstream commit 65f921647f4c89a2068478c89691f39b309b58f7 ]

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory beyond the endpoint array should a
malicious device lack the expected endpoints.

Fixes: e0d3bafd0258 ("V4L/DVB (10954): Add cx231xx USB driver")

Cc: stable      # 2.6.30
Cc: Sri Deevi 
Signed-off-by: Johan Hovold 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

[media] cx231xx-audio: fix init error path

2017-05-17T19:08:22+00:00

[ Upstream commit fff1abc4d54e469140a699612b4db8d6397bfcba ]

Make sure to release the snd_card also on a late allocation error.

Fixes: e0d3bafd0258 ("V4L/DVB (10954): Add cx231xx USB driver")

Cc: stable      # 2.6.30
Cc: Sri Deevi 
Signed-off-by: Johan Hovold 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

[media] cx231xx-cards: fix NULL-deref at probe

2017-05-17T19:08:22+00:00

[ Upstream commit 0cd273bb5e4d1828efaaa8dfd11b7928131ed149 ]

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory beyond the endpoint array should a
malicious device lack the expected endpoints.

Fixes: e0d3bafd0258 ("V4L/DVB (10954): Add cx231xx USB driver")

Cc: stable      # 2.6.30
Cc: Sri Deevi 
Signed-off-by: Johan Hovold 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin

[media] usbvision: fix NULL-deref at probe

2017-05-17T19:08:22+00:00

[ Upstream commit eacb975b48272f54532b62f515a3cf7eefa35123 ]

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory beyond the endpoint array should a
malicious device lack the expected endpoints.

Fixes: 2a9f8b5d25be ("V4L/DVB (5206): Usbvision: set alternate interface
modification")

Cc: stable      # 2.6.21
Cc: Thierry MERLE 
Signed-off-by: Johan Hovold 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin