[PATCH] media: cx231xx: Bound audio copies by the PCM buffer size

[PATCH] media: cx231xx: Bound audio copies by the PCM buffer size

[Sinan Turunc]

cx231xx_audio_isocirq() and cx231xx_audio_bulkirq() split the copy into
the ALSA ring buffer once at the buffer end and wrap hwptr_done_capture
once, which is only correct when one packet holds at most buffer_size
frames. The packet size is max_pkt_size from the device's alternate
setting, while the hw constraints allow 64-byte periods with
periods_min 2, so a packet can be larger than the whole buffer.

Clamp length to buffer_size before the copy in both callbacks so the
single wrap stays inside the buffer.

Reproduced on 7.3-rc7 with a USB/IP device presenting a Pixelview
Xcapture interface layout and 1024-byte packets into a 128-byte buffer:

  BUG: KASAN: use-after-free in cx231xx_audio_isocirq+0x2c7/0x780
  Read of size 4294966528 at addr ffff88800e8e0400 by task vhci_rx/82

Fixes: e0d3bafd0258 ("V4L/DVB (10954): Add cx231xx USB driver")
Cc: stable@vger.kernel.org
Signed-off-by: Sinan Turunc <enscrpt@pm.me>
---
 drivers/media/usb/cx231xx/cx231xx-audio.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/drivers/media/usb/cx231xx/cx231xx-audio.c b/drivers/media/usb/cx231xx/cx231xx-audio.c
index b24ceef497e..4e5110dd160 100644
--- a/drivers/media/usb/cx231xx/cx231xx-audio.c
+++ b/drivers/media/usb/cx231xx/cx231xx-audio.c
@@ -123,6 +123,15 @@ static void cx231xx_audio_isocirq(struct urb *urb)
 			if (!length)
 				continue;
 
+			/*
+			 * A packet can carry up to max_pkt_size, which the
+			 * device chooses, while the ring buffer can be as small
+			 * as two 64-byte periods. The single wrap below is only
+			 * valid for length <= buffer_size, so keep what fits.
+			 */
+			if (unlikely(length > runtime->buffer_size))
+				length = runtime->buffer_size;
+
 			oldptr = dev->adev.hwptr_done_capture;
 			if (oldptr + length >= runtime->buffer_size) {
 				unsigned int cnt;
@@ -210,6 +219,10 @@ static void cx231xx_audio_bulkirq(struct urb *urb)
 				     stride;
 			cp = (unsigned char *)urb->transfer_buffer;
 
+			/* same bound as in cx231xx_audio_isocirq() */
+			if (unlikely(length > runtime->buffer_size))
+				length = runtime->buffer_size;
+
 			oldptr = dev->adev.hwptr_done_capture;
 			if (oldptr + length >= runtime->buffer_size) {
 				unsigned int cnt;
-- 
2.56.0