Patch "media: stk1160: fix bounds checking in stk1160_copy_video()" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    media: stk1160: fix bounds checking in stk1160_copy_video()

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit b46e4e7c9171c7c47bcb19d9bf53e534f399e2ba
Author: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Date:   Mon Apr 22 12:32:44 2024 +0300

    media: stk1160: fix bounds checking in stk1160_copy_video()
    
    [ Upstream commit faa4364bef2ec0060de381ff028d1d836600a381 ]
    
    The subtract in this condition is reversed.  The ->length is the length
    of the buffer.  The ->bytesused is how many bytes we have copied thus
    far.  When the condition is reversed that means the result of the
    subtraction is always negative but since it's unsigned then the result
    is a very high positive value.  That means the overflow check is never
    true.
    
    Additionally, the ->bytesused doesn't actually work for this purpose
    because we're not writing to "buf->mem + buf->bytesused".  Instead, the
    math to calculate the destination where we are writing is a bit
    involved.  You calculate the number of full lines already written,
    multiply by two, skip a line if necessary so that we start on an odd
    numbered line, and add the offset into the line.
    
    To fix this buffer overflow, just take the actual destination where we
    are writing, if the offset is already out of bounds print an error and
    return.  Otherwise, write up to buf->length bytes.
    
    Fixes: 9cb2173e6ea8 ("[media] media: Add stk1160 new driver (easycap replacement)")
    Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
    Reviewed-by: Ricardo Ribalda <ribalda@xxxxxxxxxxxx>
    Signed-off-by: Hans Verkuil <hverkuil-cisco@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/media/usb/stk1160/stk1160-video.c b/drivers/media/usb/stk1160/stk1160-video.c
index 4cf540d1b2501..2a5a90311e0cc 100644
--- a/drivers/media/usb/stk1160/stk1160-video.c
+++ b/drivers/media/usb/stk1160/stk1160-video.c
@@ -99,7 +99,7 @@ void stk1160_buffer_done(struct stk1160 *dev)
 static inline
 void stk1160_copy_video(struct stk1160 *dev, u8 *src, int len)
 {
-	int linesdone, lineoff, lencopy;
+	int linesdone, lineoff, lencopy, offset;
 	int bytesperline = dev->width * 2;
 	struct stk1160_buffer *buf = dev->isoc_ctl.buf;
 	u8 *dst = buf->mem;
@@ -139,8 +139,13 @@ void stk1160_copy_video(struct stk1160 *dev, u8 *src, int len)
 	 * Check if we have enough space left in the buffer.
 	 * In that case, we force loop exit after copy.
 	 */
-	if (lencopy > buf->bytesused - buf->length) {
-		lencopy = buf->bytesused - buf->length;
+	offset = dst - (u8 *)buf->mem;
+	if (offset > buf->length) {
+		dev_warn_ratelimited(dev->dev, "out of bounds offset\n");
+		return;
+	}
+	if (lencopy > buf->length - offset) {
+		lencopy = buf->length - offset;
 		remain = lencopy;
 	}
 
@@ -182,8 +187,13 @@ void stk1160_copy_video(struct stk1160 *dev, u8 *src, int len)
 		 * Check if we have enough space left in the buffer.
 		 * In that case, we force loop exit after copy.
 		 */
-		if (lencopy > buf->bytesused - buf->length) {
-			lencopy = buf->bytesused - buf->length;
+		offset = dst - (u8 *)buf->mem;
+		if (offset > buf->length) {
+			dev_warn_ratelimited(dev->dev, "offset out of bounds\n");
+			return;
+		}
+		if (lencopy > buf->length - offset) {
+			lencopy = buf->length - offset;
 			remain = lencopy;
 		}