Commit 5a4e9221 authored by Johan Hovold's avatar Johan Hovold Committed by Sasha Levin

[media] cx231xx-cards: fix NULL-deref at probe

[ Upstream commit 0cd273bb ]

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory beyond the endpoint array should a
malicious device lack the expected endpoints.

Fixes: e0d3bafd ("V4L/DVB (10954): Add cx231xx USB driver")

Cc: stable <stable@vger.kernel.org>     # 2.6.30
Cc: Sri Deevi <Srinivasa.Deevi@conexant.com>
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: default avatarSasha Levin <alexander.levin@verizon.com>
parent a44bcf6b
...@@ -1411,6 +1411,9 @@ static int cx231xx_init_v4l2(struct cx231xx *dev, ...@@ -1411,6 +1411,9 @@ static int cx231xx_init_v4l2(struct cx231xx *dev,
uif = udev->actconfig->interface[idx]; uif = udev->actconfig->interface[idx];
if (uif->altsetting[0].desc.bNumEndpoints < isoc_pipe + 1)
return -ENODEV;
dev->video_mode.end_point_addr = uif->altsetting[0].endpoint[isoc_pipe].desc.bEndpointAddress; dev->video_mode.end_point_addr = uif->altsetting[0].endpoint[isoc_pipe].desc.bEndpointAddress;
dev->video_mode.num_alt = uif->num_altsetting; dev->video_mode.num_alt = uif->num_altsetting;
...@@ -1424,7 +1427,12 @@ static int cx231xx_init_v4l2(struct cx231xx *dev, ...@@ -1424,7 +1427,12 @@ static int cx231xx_init_v4l2(struct cx231xx *dev,
return -ENOMEM; return -ENOMEM;
for (i = 0; i < dev->video_mode.num_alt; i++) { for (i = 0; i < dev->video_mode.num_alt; i++) {
u16 tmp = le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].desc.wMaxPacketSize); u16 tmp;
if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe + 1)
return -ENODEV;
tmp = le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].desc.wMaxPacketSize);
dev->video_mode.alt_max_pkt_size[i] = (tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1); dev->video_mode.alt_max_pkt_size[i] = (tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1);
dev_dbg(dev->dev, dev_dbg(dev->dev,
"Alternate setting %i, max size= %i\n", i, "Alternate setting %i, max size= %i\n", i,
...@@ -1441,6 +1449,9 @@ static int cx231xx_init_v4l2(struct cx231xx *dev, ...@@ -1441,6 +1449,9 @@ static int cx231xx_init_v4l2(struct cx231xx *dev,
} }
uif = udev->actconfig->interface[idx]; uif = udev->actconfig->interface[idx];
if (uif->altsetting[0].desc.bNumEndpoints < isoc_pipe + 1)
return -ENODEV;
dev->vbi_mode.end_point_addr = dev->vbi_mode.end_point_addr =
uif->altsetting[0].endpoint[isoc_pipe].desc. uif->altsetting[0].endpoint[isoc_pipe].desc.
bEndpointAddress; bEndpointAddress;
...@@ -1457,8 +1468,12 @@ static int cx231xx_init_v4l2(struct cx231xx *dev, ...@@ -1457,8 +1468,12 @@ static int cx231xx_init_v4l2(struct cx231xx *dev,
return -ENOMEM; return -ENOMEM;
for (i = 0; i < dev->vbi_mode.num_alt; i++) { for (i = 0; i < dev->vbi_mode.num_alt; i++) {
u16 tmp = u16 tmp;
le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].
if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe + 1)
return -ENODEV;
tmp = le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].
desc.wMaxPacketSize); desc.wMaxPacketSize);
dev->vbi_mode.alt_max_pkt_size[i] = dev->vbi_mode.alt_max_pkt_size[i] =
(tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1); (tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1);
...@@ -1478,6 +1493,9 @@ static int cx231xx_init_v4l2(struct cx231xx *dev, ...@@ -1478,6 +1493,9 @@ static int cx231xx_init_v4l2(struct cx231xx *dev,
} }
uif = udev->actconfig->interface[idx]; uif = udev->actconfig->interface[idx];
if (uif->altsetting[0].desc.bNumEndpoints < isoc_pipe + 1)
return -ENODEV;
dev->sliced_cc_mode.end_point_addr = dev->sliced_cc_mode.end_point_addr =
uif->altsetting[0].endpoint[isoc_pipe].desc. uif->altsetting[0].endpoint[isoc_pipe].desc.
bEndpointAddress; bEndpointAddress;
...@@ -1492,7 +1510,12 @@ static int cx231xx_init_v4l2(struct cx231xx *dev, ...@@ -1492,7 +1510,12 @@ static int cx231xx_init_v4l2(struct cx231xx *dev,
return -ENOMEM; return -ENOMEM;
for (i = 0; i < dev->sliced_cc_mode.num_alt; i++) { for (i = 0; i < dev->sliced_cc_mode.num_alt; i++) {
u16 tmp = le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe]. u16 tmp;
if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe + 1)
return -ENODEV;
tmp = le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].
desc.wMaxPacketSize); desc.wMaxPacketSize);
dev->sliced_cc_mode.alt_max_pkt_size[i] = dev->sliced_cc_mode.alt_max_pkt_size[i] =
(tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1); (tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1);
...@@ -1657,6 +1680,11 @@ static int cx231xx_usb_probe(struct usb_interface *interface, ...@@ -1657,6 +1680,11 @@ static int cx231xx_usb_probe(struct usb_interface *interface,
} }
uif = udev->actconfig->interface[idx]; uif = udev->actconfig->interface[idx];
if (uif->altsetting[0].desc.bNumEndpoints < isoc_pipe + 1) {
retval = -ENODEV;
goto err_video_alt;
}
dev->ts1_mode.end_point_addr = dev->ts1_mode.end_point_addr =
uif->altsetting[0].endpoint[isoc_pipe]. uif->altsetting[0].endpoint[isoc_pipe].
desc.bEndpointAddress; desc.bEndpointAddress;
...@@ -1674,7 +1702,14 @@ static int cx231xx_usb_probe(struct usb_interface *interface, ...@@ -1674,7 +1702,14 @@ static int cx231xx_usb_probe(struct usb_interface *interface,
} }
for (i = 0; i < dev->ts1_mode.num_alt; i++) { for (i = 0; i < dev->ts1_mode.num_alt; i++) {
u16 tmp = le16_to_cpu(uif->altsetting[i]. u16 tmp;
if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe + 1) {
retval = -ENODEV;
goto err_video_alt;
}
tmp = le16_to_cpu(uif->altsetting[i].
endpoint[isoc_pipe].desc. endpoint[isoc_pipe].desc.
wMaxPacketSize); wMaxPacketSize);
dev->ts1_mode.alt_max_pkt_size[i] = dev->ts1_mode.alt_max_pkt_size[i] =
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment