* [PATCH] media: rc: validate that "rc_proto" is reasonable
@ 2020-10-30 11:52 Dan Carpenter
2020-11-01 11:04 ` Sean Young
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2020-10-30 11:52 UTC (permalink / raw)
To: Sean Young; +Cc: Mauro Carvalho Chehab, linux-media, kernel-janitors
Smatch complains that "rc_proto" comes from the user and it can result
in shift wrapping in ir_raw_encode_scancode()
drivers/media/rc/rc-ir-raw.c:526 ir_raw_encode_scancode()
error: undefined (user controlled) shift '1 << protocol'
This is true, but I reviewed the surrounding code and it appears
harmless. Anyway, let's verify that "rc_proto" is valid as a kernel
hardenning measure.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/media/rc/lirc_dev.c | 3 ++-
include/uapi/linux/lirc.h | 1 +
2 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/include/uapi/linux/lirc.h b/include/uapi/linux/lirc.h
index f99d9dcae667..c1eb960adde3 100644
--- a/include/uapi/linux/lirc.h
+++ b/include/uapi/linux/lirc.h
@@ -226,6 +226,7 @@ enum rc_proto {
RC_PROTO_RCMM24 = 25,
RC_PROTO_RCMM32 = 26,
RC_PROTO_XBOX_DVD = 27,
+ RC_PROTO_MAX = RC_PROTO_XBOX_DVD,
};
#endif
diff --git a/drivers/media/rc/lirc_dev.c b/drivers/media/rc/lirc_dev.c
index 220363b9a868..116daf90c858 100644
--- a/drivers/media/rc/lirc_dev.c
+++ b/drivers/media/rc/lirc_dev.c
@@ -263,7 +263,8 @@ static ssize_t lirc_transmit(struct file *file, const char __user *buf,
goto out_unlock;
}
- if (scan.flags || scan.keycode || scan.timestamp) {
+ if (scan.flags || scan.keycode || scan.timestamp ||
+ scan.rc_proto > RC_PROTO_MAX) {
ret = -EINVAL;
goto out_unlock;
}
--
2.28.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] media: rc: validate that "rc_proto" is reasonable
2020-10-30 11:52 [PATCH] media: rc: validate that "rc_proto" is reasonable Dan Carpenter
@ 2020-11-01 11:04 ` Sean Young
0 siblings, 0 replies; 2+ messages in thread
From: Sean Young @ 2020-11-01 11:04 UTC (permalink / raw)
To: Dan Carpenter; +Cc: Mauro Carvalho Chehab, linux-media, kernel-janitors
Hi Dan,
On Fri, Oct 30, 2020 at 02:52:30PM +0300, Dan Carpenter wrote:
> Smatch complains that "rc_proto" comes from the user and it can result
> in shift wrapping in ir_raw_encode_scancode()
>
> drivers/media/rc/rc-ir-raw.c:526 ir_raw_encode_scancode()
> error: undefined (user controlled) shift '1 << protocol'
>
> This is true, but I reviewed the surrounding code and it appears
> harmless. Anyway, let's verify that "rc_proto" is valid as a kernel
> hardenning measure.
It would mean that suddenly an invalid rc proto could become valid; also
like you say, this is a good hardening measure.
Good catch, thank you.
Regards,
Sean
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> drivers/media/rc/lirc_dev.c | 3 ++-
> include/uapi/linux/lirc.h | 1 +
> 2 files changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/include/uapi/linux/lirc.h b/include/uapi/linux/lirc.h
> index f99d9dcae667..c1eb960adde3 100644
> --- a/include/uapi/linux/lirc.h
> +++ b/include/uapi/linux/lirc.h
> @@ -226,6 +226,7 @@ enum rc_proto {
> RC_PROTO_RCMM24 = 25,
> RC_PROTO_RCMM32 = 26,
> RC_PROTO_XBOX_DVD = 27,
> + RC_PROTO_MAX = RC_PROTO_XBOX_DVD,
> };
>
> #endif
> diff --git a/drivers/media/rc/lirc_dev.c b/drivers/media/rc/lirc_dev.c
> index 220363b9a868..116daf90c858 100644
> --- a/drivers/media/rc/lirc_dev.c
> +++ b/drivers/media/rc/lirc_dev.c
> @@ -263,7 +263,8 @@ static ssize_t lirc_transmit(struct file *file, const char __user *buf,
> goto out_unlock;
> }
>
> - if (scan.flags || scan.keycode || scan.timestamp) {
> + if (scan.flags || scan.keycode || scan.timestamp ||
> + scan.rc_proto > RC_PROTO_MAX) {
> ret = -EINVAL;
> goto out_unlock;
> }
> --
> 2.28.0
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-11-01 11:04 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-10-30 11:52 [PATCH] media: rc: validate that "rc_proto" is reasonable Dan Carpenter
2020-11-01 11:04 ` Sean Young
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).