From: Dongliang Mu <mudongliangabcd@gmail.com>
To: mchehab@kernel.org, linux-media@vger.kernel.org,
linux-kernel@vger.kernel.org, mudongliangabcd@gmail.com
Subject: [PATCH] Fix shift-out-of-bound in mceusb_process_ir_data
Date: Wed, 13 Jan 2021 19:11:22 +0800 [thread overview]
Message-ID: <20210113111122.1739478-1-mudongliangabcd@gmail.com> (raw)
The missing check of ir->buf_in[i+1] can lead to an shift-out-of-bound
in mceusb_handle_command or mceusb_dev_printdata. This patch adds a
check to limit its value lower than 16. The concrete report of UBSAN is
as follows.
UBSAN: shift-out-of-bounds in drivers/media/rc/mceusb.c:704:13
shift exponent 230 is too large for 32-bit type 'unsigned int'
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.10.0-syzkaller #0
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:79 [inline]
dump_stack+0x107/0x163 lib/dump_stack.c:120
ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
__ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395
mceusb_dev_printdata.cold+0x19/0x1e drivers/media/rc/mceusb.c:704
mceusb_process_ir_data drivers/media/rc/mceusb.c:1275 [inline]
mceusb_dev_recv+0x3cb/0x1990 drivers/media/rc/mceusb.c:1376
__usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1657
usb_hcd_giveback_urb+0x38c/0x430 drivers/usb/core/hcd.c:1728
dummy_timer+0x11f4/0x32a0 drivers/usb/gadget/udc/dummy_hcd.c:1971
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
---
drivers/media/rc/mceusb.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c
index f9616158bcf4..755808c6e747 100644
--- a/drivers/media/rc/mceusb.c
+++ b/drivers/media/rc/mceusb.c
@@ -1272,6 +1272,8 @@ static void mceusb_process_ir_data(struct mceusb_dev *ir, int buf_len)
switch (ir->parser_state) {
case SUBCMD:
ir->rem = mceusb_cmd_datasize(ir->cmd, ir->buf_in[i]);
+ if (ir->buf_in[i+1] >= 16)
+ continue;
mceusb_dev_printdata(ir, ir->buf_in, buf_len, i - 1,
ir->rem + 2, false);
if (i + ir->rem < buf_len)
--
2.25.1
next reply other threads:[~2021-01-13 11:12 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-13 11:11 Dongliang Mu [this message]
2021-01-13 14:27 ` [PATCH] Fix shift-out-of-bound in mceusb_process_ir_data Sean Young
2021-01-14 3:03 ` 慕冬亮
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210113111122.1739478-1-mudongliangabcd@gmail.com \
--to=mudongliangabcd@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).