Patch "media: uvcvideo: Fix missing check to determine if element is found in list" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    media: uvcvideo: Fix missing check to determine if element is found in list

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     media-uvcvideo-fix-missing-check-to-determine-if-ele.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 9bd0fd7e701ba8d94b8a07206ef9a0cd6dccb868
Author: Xiaomeng Tong <xiam0nd.tong@xxxxxxxxx>
Date:   Sat Mar 19 11:22:22 2022 +0100

    media: uvcvideo: Fix missing check to determine if element is found in list
    
    [ Upstream commit 261f33388c29f6f3c12a724e6d89172b7f6d5996 ]
    
    The list iterator will point to a bogus position containing HEAD if
    the list is empty or the element is not found in list. This case
    should be checked before any use of the iterator, otherwise it will
    lead to a invalid memory access. The missing check here is before
    "pin = iterm->id;", just add check here to fix the security bug.
    
    In addition, the list iterator value will *always* be set and non-NULL
    by list_for_each_entry(), so it is incorrect to assume that the iterator
    value will be NULL if the element is not found in list, considering
    the (mis)use here: "if (iterm == NULL".
    
    Use a new value 'it' as the list iterator, while use the old value
    'iterm' as a dedicated pointer to point to the found element, which
    1. can fix this bug, due to 'iterm' is NULL only if it's not found.
    2. do not need to change all the uses of 'iterm' after the loop.
    3. can also limit the scope of the list iterator 'it' *only inside*
       the traversal loop by simply declaring 'it' inside the loop in the
       future, as usage of the iterator outside of the list_for_each_entry
       is considered harmful. https://lkml.org/lkml/2022/2/17/1032
    
    Fixes: d5e90b7a6cd1c ("[media] uvcvideo: Move to video_ioctl2")
    Signed-off-by: Xiaomeng Tong <xiam0nd.tong@xxxxxxxxx>
    Signed-off-by: Laurent Pinchart <laurent.pinchart@xxxxxxxxxxxxxxxx>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
index c9d208677bcd..63842eb223a1 100644
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -864,29 +864,31 @@ static int uvc_ioctl_enum_input(struct file *file, void *fh,
 	struct uvc_video_chain *chain = handle->chain;
 	const struct uvc_entity *selector = chain->selector;
 	struct uvc_entity *iterm = NULL;
+	struct uvc_entity *it;
 	u32 index = input->index;
-	int pin = 0;
 
 	if (selector == NULL ||
 	    (chain->dev->quirks & UVC_QUIRK_IGNORE_SELECTOR_UNIT)) {
 		if (index != 0)
 			return -EINVAL;
-		list_for_each_entry(iterm, &chain->entities, chain) {
-			if (UVC_ENTITY_IS_ITERM(iterm))
+		list_for_each_entry(it, &chain->entities, chain) {
+			if (UVC_ENTITY_IS_ITERM(it)) {
+				iterm = it;
 				break;
+			}
 		}
-		pin = iterm->id;
 	} else if (index < selector->bNrInPins) {
-		pin = selector->baSourceID[index];
-		list_for_each_entry(iterm, &chain->entities, chain) {
-			if (!UVC_ENTITY_IS_ITERM(iterm))
+		list_for_each_entry(it, &chain->entities, chain) {
+			if (!UVC_ENTITY_IS_ITERM(it))
 				continue;
-			if (iterm->id == pin)
+			if (it->id == selector->baSourceID[index]) {
+				iterm = it;
 				break;
+			}
 		}
 	}
 
-	if (iterm == NULL || iterm->id != pin)
+	if (iterm == NULL)
 		return -EINVAL;
 
 	memset(input, 0, sizeof(*input));