[PATCH] media: gspca: Fix crash in sonixj driver

[PATCH] media: gspca: Fix crash in sonixj driver

[Kanav Gupta]

Fix a race condition in the sonixj driver where if the last byte of the
previous packet was 0xff, but the new packet doesn't start with 0xff00 or
0xffff, it would subtract -1 from length (effectively +1) and add -1 to
data (effectively -1) which caused it to read one byte early in
gspca_frame_add which led to a crash when running memcpy.

Kernel logs of the crash:

[  344.258380] #PF: supervisor read access in kernel mode
[  344.258388] #PF: error_code(0x0000) - not-present page
[  344.258395] PGD 100000067 P4D 100000067 PUD 1002dd067 PMD 10f21a067 PTE 0
[  344.258413] Oops: Oops: 0000 [#1] SMP NOPTI
[  344.258425] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.2.4-arch1-2 #1 PREEMPT(full)  ceab5b7eb60a89a58d616500ee9fef4aad8789ba
[  344.258440] Hardware name: Dell Inc. Inspiron 16 5625/08HCFW, BIOS 1.23.0 04/22/2025
[  344.258448] RIP: 0010:memcpy+0xc/0x30
[  344.258464] Code: 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 48 89 f8 48 89 d1 <f3> a4 e9 98 2d b7 fe 66 90 66 66 2e 0f 1f 84 00 00 00 00 00 90 90
[  344.258472] RSP: 0018:ffffcde8c0003e08 EFLAGS: 00010286
[  344.258481] RAX: ffffcde8cb7163e1 RBX: ffff8bf8128bf000 RCX: 0000000000000385
[  344.258487] RDX: 0000000000000385 RSI: ffffcde8cb78ffff RDI: ffffcde8cb7163e1
[  344.258492] RBP: ffff8bf82122f000 R08: ffffcde8cb78ffff R09: 0000000000000385
[  344.258497] R10: ffff8bf8128bf000 R11: fefefefefefefeff R12: ffff8bf8128bf000
[  344.258503] R13: 0000000000000002 R14: 0000000000000385 R15: ffffcde8cb78ffff
[  344.258509] FS:  0000000000000000(0000) GS:ffff8bfb7492d000(0000) knlGS:0000000000000000
[  344.258515] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  344.258521] CR2: ffffcde8cb78ffff CR3: 0000000105e22000 CR4: 0000000000f50ef0
[  344.258527] PKRU: 55555554
[  344.258532] Call Trace:
[  344.258538]  <IRQ>
[  344.258544]  gspca_frame_add+0xd0/0x290 [gspca_main 5a055b32c806e417235e8d5e2742e9a578ee2b8a]
[  344.258559]  ? __queue_work+0x16c/0x570
[  344.258573]  ? __pfx_sd_pkt_scan+0x10/0x10 [gspca_sonixj 9778522355db5c2cbeafad6bd503d60db422b3ff]
[  344.258586]  isoc_irq+0xd2/0x170 [gspca_main 5a055b32c806e417235e8d5e2742e9a578ee2b8a]
[  344.258600]  __usb_hcd_giveback_urb+0xa0/0x120
[  344.258613]  usb_giveback_urb_bh+0xc0/0x140
[  344.258625]  process_one_work+0x19f/0x370
[  344.258636]  bh_worker+0x1d2/0x1f0
[  344.258644]  ? sched_clock_cpu+0xf/0x1f0
[  344.258655]  tasklet_hi_action+0x13/0x30
[  344.258664]  handle_softirqs+0xe8/0x2a0
[  344.258675]  __irq_exit_rcu+0xb0/0x100
[  344.258680]  common_interrupt+0x85/0xa0
[  344.258687]  </IRQ>
[  344.258690]  <TASK>
[  344.258693]  asm_common_interrupt+0x26/0x40
[  344.258699] RIP: 0010:cpuidle_enter_state+0xbb/0x400
[  344.258704] Code: 00 00 e8 68 b3 e8 fe e8 23 ee ff ff 48 89 c5 0f 1f 44 00 00 31 ff e8 54 3e e6 fe 45 84 ff 0f 85 48 01 00 00 fb 0f 1f 44 00 00 <45> 85 f6 0f 88 9f 01 00 00 44 89 f1 48 2b 2c 24 48 6b d1 68 48 89
[  344.258708] RSP: 0018:ffffffff89003e18 EFLAGS: 00000246
[  344.258712] RAX: ffff8bfb7492d000 RBX: 0000000000000003 RCX: 0000000000000000
[  344.258716] RDX: 0000005027642b7f RSI: fffffffb85bb9d7d RDI: 0000000000000000
[  344.258719] RBP: 0000005027642b7f R08: ffffffff89219480 R09: 000000000000000f
[  344.258722] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8bf801221c00
[  344.258725] R13: ffffffff89219480 R14: 0000000000000003 R15: 0000000000000000
[  344.258733]  ? cpuidle_enter_state+0xac/0x400
[  344.258740]  cpuidle_enter+0x31/0x50
[  344.258748]  do_idle+0x1cc/0x2e0
[  344.258757]  cpu_startup_entry+0x29/0x30
[  344.258762]  rest_init+0xcc/0xd0
[  344.258768]  start_kernel+0xa56/0xa70
[  344.258778]  x86_64_start_reservations+0x24/0x30
[  344.258786]  x86_64_start_kernel+0xda/0xe0
[  344.258792]  common_startup_64+0x13e/0x151
[  344.258805]  </TASK>

Sorry if it isn't perfect, this is my first 

Signed-off-by: Kanav Gupta <email.kanavg@gmail.com>
---
 drivers/media/usb/gspca/sonixj.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/drivers/media/usb/gspca/sonixj.c b/drivers/media/usb/gspca/sonixj.c
index 2e1bd2df8..03f40575a 100644
--- a/drivers/media/usb/gspca/sonixj.c
+++ b/drivers/media/usb/gspca/sonixj.c
@@ -2695,18 +2695,19 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 	i = sd->short_mark;
 	if (i != 0) {
 		sd->short_mark = 0;
-		if (i < 0	/* if 'ff' at end of previous packet */
-		 && data[0] == 0xff
-		 && data[1] == 0x00)
-			goto marker_found;
 		if (data[0] == 0xff && data[1] == 0xff) {
 			i = 0;
 			goto marker_found;
 		}
-		len -= i;
-		if (len <= 0)
-			return;
-		data += i;
+		if (i < 0) {	/* if 'ff' at end of previous packet */
+			if (data[0] == 0xff && data[1] == 0x00)
+				goto marker_found;
+		} else {
+			len -= i;
+			if (len <= 0)
+				return;
+			data += i;
+		}
 	}
 
 	/* search backwards if there is a marker in the packet */
-- 
2.47.3