tree 8f015098831e9abc6dae9ef33e47482c6f1a717c
parent 54ab5b6e2f46868c2a670dc0093ff941671e9d52
author Alexander Larkin <avlarkin82@gmail.com> 1625463576 -0700
committer Oleksandr Tymoshenko <ovt@google.com> 1631666654 +0000

Input: joydev - prevent use of not validated data in JSIOCSBTNMAP ioctl

commit f8f84af5da9ee04ef1d271528656dac42a090d00 upstream.

Even though we validate user-provided inputs we then traverse past
validated data when applying the new map. The issue was originally
discovered by Murray McAllister with this simple POC (if the following
is executed by an unprivileged user it will instantly panic the system):

int main(void) {
	int fd, ret;
	unsigned int buffer[10000];

	fd = open("/dev/input/js0", O_RDONLY);
	if (fd == -1)
		printf("Error opening file\n");

	ret = ioctl(fd, JSIOCSBTNMAP & ~IOCSIZE_MASK, &buffer);
	printf("%d\n", ret);
}

The solution is to traverse internal buffer which is guaranteed to only
contain valid date when constructing the map.

BUG=b/193628522
TEST=presubmit
SOURCE=UPSTREAM(0f382fa359ca1cb717ce27407538eb579b29a99f)
RELEASE_NOTE=Fixed CVE-2021-3612

cos-patch: security-high
Fixes: 182d679b2298 ("Input: joydev - prevent potential read overflow in ioctl")
Fixes: 999b874f4aa3 ("Input: joydev - validate axis/button maps before clobbering current ones")
Reported-by: Murray McAllister <murray.mcallister@gmail.com>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Alexander Larkin <avlarkin82@gmail.com>
Link: https://lore.kernel.org/r/20210620120030.1513655-1-avlarkin82@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I75c17ec0b4275130a246acb54909c9d126065acb
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/22538
Reviewed-by: Vaibhav Rustagi <vaibhavrustagi@google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>