forge/linux-uconsole
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions
linux-uconsole/drivers/media/usb
History
Vandana BN 0648766cb7 media: usb:zr364xx:Fix KASAN:null-ptr-deref Read in zr364xx_vidioc_querycap 
commit 5d2e73a5f8 upstream.

SyzKaller hit the null pointer deref while reading from uninitialized
udev->product in zr364xx_vidioc_querycap().

==================================================================
BUG: KASAN: null-ptr-deref in read_word_at_a_time+0xe/0x20
include/linux/compiler.h:274
Read of size 1 at addr 0000000000000000 by task v4l_id/5287

CPU: 1 PID: 5287 Comm: v4l_id Not tainted 5.1.0-rc3-319004-g43151d6 #6
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
  __dump_stack lib/dump_stack.c:77 [inline]
  dump_stack+0xe8/0x16e lib/dump_stack.c:113
  kasan_report.cold+0x5/0x3c mm/kasan/report.c:321
  read_word_at_a_time+0xe/0x20 include/linux/compiler.h:274
  strscpy+0x8a/0x280 lib/string.c:207
  zr364xx_vidioc_querycap+0xb5/0x210 drivers/media/usb/zr364xx/zr364xx.c:706
  v4l_querycap+0x12b/0x340 drivers/media/v4l2-core/v4l2-ioctl.c:1062
  __video_do_ioctl+0x5bb/0xb40 drivers/media/v4l2-core/v4l2-ioctl.c:2874
  video_usercopy+0x44e/0xf00 drivers/media/v4l2-core/v4l2-ioctl.c:3056
  v4l2_ioctl+0x14e/0x1a0 drivers/media/v4l2-core/v4l2-dev.c:364
  vfs_ioctl fs/ioctl.c:46 [inline]
  file_ioctl fs/ioctl.c:509 [inline]
  do_vfs_ioctl+0xced/0x12f0 fs/ioctl.c:696
  ksys_ioctl+0xa0/0xc0 fs/ioctl.c:713
  __do_sys_ioctl fs/ioctl.c:720 [inline]
  __se_sys_ioctl fs/ioctl.c:718 [inline]
  __x64_sys_ioctl+0x74/0xb0 fs/ioctl.c:718
  do_syscall_64+0xcf/0x4f0 arch/x86/entry/common.c:290
  entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f3b56d8b347
Code: 90 90 90 48 8b 05 f1 fa 2a 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff
ff c3 90 90 90 90 90 90 90 90 90 90 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff
ff 73 01 c3 48 8b 0d c1 fa 2a 00 31 d2 48 29 c2 64
RSP: 002b:00007ffe005d5d68 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f3b56d8b347
RDX: 00007ffe005d5d70 RSI: 0000000080685600 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000400884
R13: 00007ffe005d5ec0 R14: 0000000000000000 R15: 0000000000000000
==================================================================

For this device udev->product is not initialized and accessing it causes a NULL pointer deref.

The fix is to check for NULL before strscpy() and copy empty string, if
product is NULL

Reported-by: syzbot+66010012fd4c531a1a96@syzkaller.appspotmail.com
Signed-off-by: Vandana BN <bnvandana@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
[bwh: Backported to 4.19: This function uses strlcpy() instead of strscpy()]
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-17 19:46:57 +01:00
..
airspy
as102 media: fix usage of whitespaces and on indentation 2018-01-04 13:12:01 -05:00
au0828 media: au0828: Fix incorrect error messages 2019-11-20 18:47:16 +01:00
b2c2 media: flexcop-usb: ensure -EIO is returned on error condition 2020-01-09 10:19:05 +01:00
cpia2 media: cpia2_usb: fix memory leaks 2019-10-05 13:09:49 +02:00
cx231xx media: cx231xx: fix potential sign-extension overflow on large shift 2019-11-24 08:20:48 +01:00
dvb-usb media: usb: fix memory leak in af9005_identify_state 2020-01-09 10:19:06 +01:00
dvb-usb-v2 media: dvbsky: Avoid leaking dvb frontend 2019-05-31 06:46:32 -07:00
em28xx media: em28xx: modules workqueue not inited for 2nd device 2019-10-05 13:09:41 +02:00
go7007 media: go7007: avoid clang frame overflow warning with KASAN 2019-05-31 06:46:33 -07:00
gspca media: sn9c20x: Add MSI MS-1039 laptop to flip_dmi_table 2019-10-05 13:10:05 +02:00
hackrf media: usb: hackrf: Replace GFP_ATOMIC with GFP_KERNEL 2018-08-02 19:16:17 -04:00
hdpvr media: hdpvr: add terminating 0 at end of string 2019-10-05 13:09:44 +02:00
msi2500
pulse8-cec media: pulse8-cec: fix lost cec_transmit_attempt_done() call 2020-01-09 10:19:00 +01:00
pvrusb2 media: pvrusb2: Fix oops on tear-down when radio support is not present 2019-12-31 16:35:55 +01:00
pwc media: replace all <spaces><tab> occurrences 2018-01-04 13:15:05 -05:00
rainshadow-cec
s2255 media: s2255drv: fix a casting warning 2018-03-23 06:56:55 -04:00
siano media: smsusb: better handle optional alignment 2019-06-09 09:17:12 +02:00
stk1160 media: stk1160: Set the vb2_queue lock before calling vb2_queue_init 2018-07-04 08:03:43 -04:00
stkwebcam media: stkwebcam: Bugfix for wrong return values 2019-12-13 08:52:28 +01:00
tm6000 media: tm6000: double free if usb disconnect while streaming 2019-09-21 07:16:42 +02:00
ttusb-budget media updates for v4.16-rc1 2018-02-06 11:27:48 -08:00
ttusb-dec media: ttusb-dec: Fix info-leak in ttusb_dec_send_command() 2019-10-05 13:09:58 +02:00
usbtv media: usbtv: use irqsave() in USB's complete callback 2018-08-02 14:17:15 -04:00
usbvision media: usbvision: Fix races among open, close, and disconnect 2019-12-01 09:17:39 +01:00
uvc media: uvcvideo: Abstract streaming object lifetime 2019-12-13 08:52:27 +01:00
zr364xx media: usb:zr364xx:Fix KASAN:null-ptr-deref Read in zr364xx_vidioc_querycap 2020-01-17 19:46:57 +01:00
Kconfig
Makefile