From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1752218AbdIVNTf (ORCPT <rfc822;w@1wt.eu>);
        Fri, 22 Sep 2017 09:19:35 -0400
Received: from mx2.suse.de ([195.135.220.15]:55992 "EHLO mx1.suse.de"
        rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP
        id S1751877AbdIVNTe (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
        Fri, 22 Sep 2017 09:19:34 -0400
Date: Fri, 22 Sep 2017 15:19:31 +0200
Message-ID: <s5htvzudg64.wl-tiwai@suse.de>
From: Takashi Iwai <tiwai@suse.de>
To: "Andrey Konovalov" <andreyknvl@google.com>
Cc: <alsa-devel@alsa-project.org>,
        "Arvind Yadav" <arvind.yadav.cs@gmail.com>,
        "Jaroslav Kysela" <perex@perex.cz>,
        "LKML" <linux-kernel@vger.kernel.org>,
        "Dmitry Vyukov" <dvyukov@google.com>,
        "Kostya Serebryany" <kcc@google.com>,
        "syzkaller" <syzkaller@googlegroups.com>
Subject: Re: usb/sounds: slab-out-of-bounds read in snd_usb_create_streams
In-Reply-To: <CAAeHK+zNjunETPXqN5kYH3mzxoaKJjeYj8+LESKs0cFuQGs4ew@mail.gmail.com>
References: <CAAeHK+zNjunETPXqN5kYH3mzxoaKJjeYj8+LESKs0cFuQGs4ew@mail.gmail.com>
User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka)
 FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/25.2
 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO)
MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka")
Content-Type: text/plain; charset=US-ASCII
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Fri, 22 Sep 2017 14:56:06 +0200,
Andrey Konovalov wrote:
> 
> Hi!
> 
> I've got the following report while fuzzing the kernel with syzkaller.
> 
> On commit ebb2c2437d8008d46796902ff390653822af6cc4 (Sep 18).
> 
> It seems that there's no check that control_header has enough space
> for uac1_ac_header_descriptor in snd_usb_create_streams().

Indeed, this might be an issue.
Does the patch below fix the problem?


Takashi

---
diff --git a/sound/usb/card.c b/sound/usb/card.c
index 3dc36d913550..fc969efbb37c 100644
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -221,6 +221,7 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif)
 	struct usb_interface_descriptor *altsd;
 	void *control_header;
 	int i, protocol;
+	int rest_bytes;
 
 	/* find audiocontrol interface */
 	host_iface = &usb_ifnum_to_if(dev, ctrlif)->altsetting[0];
@@ -235,6 +236,13 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif)
 		return -EINVAL;
 	}
 
+	rest_bytes = (void *)(host_iface->extra + host_iface->extralen) -
+		control_header;
+	if (rest_bytes <= 0) {
+		dev_err(&dev->dev, "invalid control header\n");
+		return -EINVAL;
+	}
+
 	switch (protocol) {
 	default:
 		dev_warn(&dev->dev,
@@ -245,11 +253,21 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif)
 	case UAC_VERSION_1: {
 		struct uac1_ac_header_descriptor *h1 = control_header;
 
+		if (rest_bytes < sizeof(*h1)) {
+			dev_err(&dev->dev, "too short v1 buffer descriptor\n");
+			return -EINVAL;
+		}
+
 		if (!h1->bInCollection) {
 			dev_info(&dev->dev, "skipping empty audio interface (v1)\n");
 			return -EINVAL;
 		}
 
+		if (rest_bytes < h1->bLength) {
+			dev_err(&dev->dev, "invalid buffer length (v1)\n");
+			return -EINVAL;
+		}
+
 		if (h1->bLength < sizeof(*h1) + h1->bInCollection) {
 			dev_err(&dev->dev, "invalid UAC_HEADER (v1)\n");
 			return -EINVAL;