From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f181.google.com (mail-pg1-f181.google.com [209.85.215.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 83E452C0260 for ; Wed, 1 Jul 2026 08:28:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.181 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782894490; cv=none; b=rdbpMns4nNdYql7KTqfBOerHqE385Xm7GyCshLL4S44hBwbGAFDX6PTWti3iURQktA38MwDPy2qfSFHZcKnL6n/QXhr5Jybed3q8XBOt2oPWX6gpWWysHu/n8Gh1Cs4/9ujzAvqZCxvoZVPTM39oKztoVM3KtLYiGaJ9EP6Te6o= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782894490; c=relaxed/simple; bh=m+sTkuPmUG+TP6asPhvScokp8Gu1v7O8erYhXoNOoMQ=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=lit7hGPlG9RSifxy4hDQW6lIXwejbk0Ku6rFZLY8xbjC6YKgx+HyyM2xFidKMscNFVHmxjXdx1DpntAtoi+hTGp2WRq7L8dq5sSX91zCVXK4BEP8bxxq5W90BMU6iSmFhb6gVDJOkkI/9+g1NxBSx/rpSGGr0LjW3sqBAzReSGM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=KhLbo8qX; arc=none smtp.client-ip=209.85.215.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="KhLbo8qX" Received: by mail-pg1-f181.google.com with SMTP id 41be03b00d2f7-c96c92c0980so114319a12.3 for ; Wed, 01 Jul 2026 01:28:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782894488; x=1783499288; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=/wBohDXh07XgRRT+XS4X5myskhVzkgH20x/mfcI9Fsk=; b=KhLbo8qXCDwashS+bZjhEZR83EEXUQ4AdO08mHRPg5XgFCm4jU1pjFkALgm/L0Vs/7 VeNItjys2QvCOy1ti+evQFX1JecJydxYmQ1ilZOp4i0JqKgRodyrCHkQnLLx9d+tkzyx nsNJ14vcI7s06TXEEN1i9x/XF6UOaqRRYFBCBxCvq8GN1Gc+xBpFFiuwkxSzR7fZKb46 F/Vn4V/AOO++kr/tvncOMGk+X88/F2OPDImXkiJgcM8NtsiDn/7cb7SGjfsmZ4e1SLc/ e+JDrjv4FsEcixwJYm4SRfUdyS87agvCoWt5mdHhAHtIHCDn9Jvq4WMnddn9iaOgFZan 4oww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782894488; x=1783499288; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=/wBohDXh07XgRRT+XS4X5myskhVzkgH20x/mfcI9Fsk=; b=hrC4O6NkWbKojcL4jlMSpN3sXouDUYcsppE2vAybrHXOodK+13DGSIMhVeQwhRyAel 5O1ZQy0Qey32lwN+mBkpoaqnYu2dmfqCc8jiGLAXHwW1PXSyG6MiqfI/HlqZW5gtCMO/ vmhdjuFuWYXXw17y57Mx0w7nnrnOZd95SV78dUYFDlPw7rXjyv0bhuHpZUO5WBcz4q1k Wme1lO9l7ApQUEMMcQ7GG6D8AAexttGn4IrYJ5unrABhSN5Qql4qS+x7YVm7q8tF9c/b IuLkuwDVGf7zN3RMqUZKDhtURA+Y1aYuqIUVXrvSj2tuFeykD7Ee7JUkQo3RWarbk5Re 6njg== X-Forwarded-Encrypted: i=1; AFNElJ8mNRAtYwWRb9eg1eyAM9KvmJivvxyz8S2VP3xT5hoCRPYYRYeMSFATq6qoXFXy3lyEG/HVgXRRFwelinQ=@vger.kernel.org X-Gm-Message-State: AOJu0YyYQcE4epbsv9v+eaD6B1pLmfh4n0ZZ8HSjKsXcTKWOoP/rAui9 bCLcOIJpzdlY0ARuTr5keYjgBnOQHRQDP/GS1WJHVESIclyXR33DD5n5 X-Gm-Gg: AfdE7cmTW+UQgu6dXsplX4XzwELAM3RC77e+y6iTC/6Rss7V8xvj8//itks6M/r7KTe d0JEkSD/PrnRxCa24PAAAxloPh1dRvMq5dQy4X8hx+jwPSTG4YtkXD3WPkfdUniJ9m1E6hY+FhY e/mIQFD4AZqTGTp387Hd2EjiYckKwEbfvLvdf4ozHda23Tdp5gB9JaGLB4mOJ6Qdi6mzgwJCrE7 iJdiAE87X3JOukPKTMa5svKSoEwc4VM5P4mEZSXKLQKb3aCibDbBEakObvLCut2IIOokORYD1Mv xQN34XUONdxfIsUMeIeI7pCMLmLxebRAezCpoOB3cFlgilSOjXVSBnpeVVfdtTadg4gNHzNk+cj 0dab54qkrOwIMFbi23JAUSce8mQXeGwfsf72/6O3hbekmK/assMiRKDR+wkOjZg8szpczzh8vhC cjVFj6Rx/CPx8VfHZ//6SqioL+sZwyRkTFB7honQ== X-Received: by 2002:a05:6a21:330f:b0:3bf:b755:ce6a with SMTP id adf61e73a8af0-3bfed104ffdmr794797637.12.1782894487661; Wed, 01 Jul 2026 01:28:07 -0700 (PDT) Received: from csl-conti-dell7858.ntu.edu.sg ([155.69.195.57]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-847a0337121sm3510477b3a.44.2026.07.01.01.28.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 01 Jul 2026 01:28:06 -0700 (PDT) From: Maoyi Xie To: Stefan Richter , Mauro Carvalho Chehab Cc: linux-media@vger.kernel.org, linux1394-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org Subject: [PATCH] media: firedtv: bound the CA reply length in avc_ca_app_info Date: Wed, 1 Jul 2026 16:28:02 +0800 Message-Id: <20260701082802.1589509-1-maoyixie.tju@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit avc_ca_app_info() copies a device length from the CI-CAM response with no bound check: memcpy(&app_info[5], &r->operand[pos], 5 + r->operand[pos + 4]); r->operand[pos + 4] is a byte the CAM controls, up to 255. app_info is the 256 byte msg[] of struct ca_msg, reached from userspace through the CA_GET_MSG ioctl. The copy starts at offset 5 and runs 5 + that byte, so a value above 246 overruns the buffer. A byte of 0xff writes about 9 bytes past it. The same idiom in avc_ca_pmt() was bounded for CVE-2021-42739 in commit 35d2969ea3c7 ("media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()"). This reply path was left unbounded. It now returns -EINVAL when the reported length would run past the 256 byte reply. Fixes: 154907957f939 ("firedtv: massive refactoring") Cc: stable@vger.kernel.org Signed-off-by: Maoyi Xie --- drivers/media/firewire/firedtv-avc.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/drivers/media/firewire/firedtv-avc.c b/drivers/media/firewire/firedtv-avc.c index a36c284121702..d77b9b802eddb 100644 --- a/drivers/media/firewire/firedtv-avc.c +++ b/drivers/media/firewire/firedtv-avc.c @@ -971,7 +971,7 @@ int avc_ca_app_info(struct firedtv *fdtv, unsigned char *app_info, { struct avc_command_frame *c = (void *)fdtv->avc_data; struct avc_response_frame *r = (void *)fdtv->avc_data; - int pos, ret; + int pos, length, ret; mutex_lock(&fdtv->avc_mutex); @@ -995,12 +995,18 @@ int avc_ca_app_info(struct firedtv *fdtv, unsigned char *app_info, /* FIXME: check response code and validate response data */ pos = get_ca_object_pos(r); + length = r->operand[pos + 4]; + /* 5 header bytes then 5 + length bytes are written to app_info */ + if (5 + 5 + length > 256) { + ret = -EINVAL; + goto out; + } app_info[0] = (EN50221_TAG_APP_INFO >> 16) & 0xff; app_info[1] = (EN50221_TAG_APP_INFO >> 8) & 0xff; app_info[2] = (EN50221_TAG_APP_INFO >> 0) & 0xff; - app_info[3] = 6 + r->operand[pos + 4]; + app_info[3] = 6 + length; app_info[4] = 0x01; - memcpy(&app_info[5], &r->operand[pos], 5 + r->operand[pos + 4]); + memcpy(&app_info[5], &r->operand[pos], 5 + length); *len = app_info[3] + 4; out: mutex_unlock(&fdtv->avc_mutex); -- 2.34.1