[PATCH] media: dvb-frontends: mt312: reject negative values in SEC callbacks

[PATCH] media: dvb-frontends: mt312: reject negative values in SEC callbacks

[Guo Zihao]

mt312_send_burst(), mt312_set_tone() and mt312_set_voltage() validate
their enum argument with an upper bound check only:

        if (c > SEC_MINI_B)
                return -EINVAL;

The arguments arrive from userspace ioctls, and the DVB core does not
sanitize them: FE_DISEQC_SEND_BURST, FE_SET_TONE and FE_SET_VOLTAGE
cast the ioctl argument straight to the enum type, so any negative
value passes the check and indexes the on-stack lookup tables
(mini_tab[2], tone_tab[2], volt_tab[3]) out of bounds, reading
adjacent kernel stack memory which is then programmed into the
DISEQC_MODE hardware register.

A negative index reads below the tables; e.g. tone_tab[-1] lands on
whatever precedes it on the stack.  Verified with a userspace copy of
the three functions under AddressSanitizer: passing -1 reports
"stack-buffer-underflow READ of size 1 ... underflows 'tone_tab'".

Switch the three checks to explicit whitelists so only the values the
tables are defined for get through.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Guo Zihao <guozh23@xiaopeng.com>
---
 drivers/media/dvb-frontends/mt312.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/media/dvb-frontends/mt312.c b/drivers/media/dvb-frontends/mt312.c
index 8fe850a8d..0c91b20cb 100644
--- a/drivers/media/dvb-frontends/mt312.c
+++ b/drivers/media/dvb-frontends/mt312.c
@@ -374,7 +374,7 @@ static int mt312_send_burst(struct dvb_frontend *fe,
 	int ret;
 	u8 diseqc_mode;
 
-	if (c > SEC_MINI_B)
+	if (c != SEC_MINI_A && c != SEC_MINI_B)
 		return -EINVAL;
 
 	ret = mt312_readreg(state, DISEQC_MODE, &diseqc_mode);
@@ -398,7 +398,7 @@ static int mt312_set_tone(struct dvb_frontend *fe,
 	int ret;
 	u8 diseqc_mode;
 
-	if (t > SEC_TONE_OFF)
+	if (t != SEC_TONE_ON && t != SEC_TONE_OFF)
 		return -EINVAL;
 
 	ret = mt312_readreg(state, DISEQC_MODE, &diseqc_mode);
@@ -420,7 +420,7 @@ static int mt312_set_voltage(struct dvb_frontend *fe,
 	const u8 volt_tab[3] = { 0x00, 0x40, 0x00 };
 	u8 val;
 
-	if (v > SEC_VOLTAGE_OFF)
+	if (v != SEC_VOLTAGE_13 && v != SEC_VOLTAGE_18 && v != SEC_VOLTAGE_OFF)
 		return -EINVAL;
 
 	val = volt_tab[v];
-- 
2.50.1