[media] uvcvideo: Fix integer overflow in uvc_ioctl_ctrl_map()

There is a potential integer overflow in uvc_ioctl_ctrl_map(). When a
large xmap->menu_count is passed from the userspace, the subsequent call
to kmalloc() will allocate a buffer smaller than expected.
map->menu_count and map->menu_info would later be used in a loop (e.g.
in uvc_query_v4l2_ctrl), which leads to out-of-bound access.

The patch checks the ioctl argument and returns -EINVAL for zero or too
large values in xmap->menu_count.

Signed-off-by: Haogang Chen <haogangchen@gmail.com>
[laurent.pinchart@ideasonboard.com Prevent excessive memory consumption]
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: stable@kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

2 files changed, 10 insertions, 0 deletions

diff --git a/drivers/media/video/uvc/uvc_v4l2.c b/drivers/media/video/uvc/uvc_v4l2.c
index b1dc3e507fc1..2ae4f880ea05 100644
--- a/drivers/media/video/uvc/uvc_v4l2.c
+++ b/drivers/media/video/uvc/uvc_v4l2.c
@@ -58,6 +58,15 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain,
                 break;
 
         case V4L2_CTRL_TYPE_MENU:
+                /* Prevent excessive memory consumption, as well as integer
+                 * overflows.
+                 */
+                if (xmap->menu_count == 0 ||
+                    xmap->menu_count > UVC_MAX_CONTROL_MENU_ENTRIES) {
+                        ret = -EINVAL;
+                        goto done;
+                }
+
                 size = xmap->menu_count * sizeof(*map->menu_info);
                 map->menu_info = kmalloc(size, GFP_KERNEL);
                 if (map->menu_info == NULL) {
diff --git a/drivers/media/video/uvc/uvcvideo.h b/drivers/media/video/uvc/uvcvideo.h
index e9c19f53e4a1..67f88d85bb16 100644
--- a/drivers/media/video/uvc/uvcvideo.h
+++ b/drivers/media/video/uvc/uvcvideo.h
@@ -114,6 +114,7 @@
 
 /* Maximum allowed number of control mappings per device */
 #define UVC_MAX_CONTROL_MAPPINGS        1024
+#define UVC_MAX_CONTROL_MENU_ENTRIES    32
 
 /* Devices quirks */
 #define UVC_QUIRK_STATUS_INTERVAL       0x00000001