| From ec369c2e5142f8b7a574d0a7035a7255f6547ddc Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Mon, 9 Jul 2018 08:15:53 -0400 |
| Subject: media: fix: media: pci: meye: validate offset to avoid arbitrary |
| access |
| |
| From: Lao Wei <zrlw@qq.com> |
| |
| [ Upstream commit eac7230fdb4672c2cb56f6a01a1744f562c01f80 ] |
| |
| Motion eye video4linux driver for Sony Vaio PictureBook desn't validate user-controlled parameter |
| 'vma->vm_pgoff', a malicious process might access all of kernel memory from user space by trying |
| pass different arbitrary address. |
| Discussion: http://www.openwall.com/lists/oss-security/2018/07/06/1 |
| |
| Signed-off-by: Lao Wei <zrlw@qq.com> |
| Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/media/pci/meye/meye.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/drivers/media/pci/meye/meye.c b/drivers/media/pci/meye/meye.c |
| index 8001d3e9134e4..db2a7ad1e5231 100644 |
| --- a/drivers/media/pci/meye/meye.c |
| +++ b/drivers/media/pci/meye/meye.c |
| @@ -1460,7 +1460,7 @@ static int meye_mmap(struct file *file, struct vm_area_struct *vma) |
| unsigned long page, pos; |
| |
| mutex_lock(&meye.lock); |
| - if (size > gbuffers * gbufsize) { |
| + if (size > gbuffers * gbufsize || offset > gbuffers * gbufsize - size) { |
| mutex_unlock(&meye.lock); |
| return -EINVAL; |
| } |
| -- |
| 2.20.1 |
| |
