tree cb400c7d6de8010a6dd5d6943c0f41c0d5f04601
parent d0c10daf210aedcc626369a82eb7727d59bc1f1a
author Alexander Larkin <avlarkin82@gmail.com> 1625463576 -0700
committer COS Cherry Picker <cloud-image-release@prod.google.com> 1626460314 -0700

Input: joydev - prevent use of not validated data in JSIOCSBTNMAP ioctl

Even though we validate user-provided inputs we then traverse past
validated data when applying the new map. The issue was originally
discovered by Murray McAllister with this simple POC (if the following
is executed by an unprivileged user it will instantly panic the system):

int main(void) {
	int fd, ret;
	unsigned int buffer[10000];

	fd = open("/dev/input/js0", O_RDONLY);
	if (fd == -1)
		printf("Error opening file\n");

	ret = ioctl(fd, JSIOCSBTNMAP & ~IOCSIZE_MASK, &buffer);
	printf("%d\n", ret);
}

The solution is to traverse internal buffer which is guaranteed to only
contain valid date when constructing the map.

BUG=b/193628631
TEST=presubmit
SOURCE=UPSTREAM(f8f84af5da9ee04ef1d271528656dac42a090d00)
RELEASE_NOTE=Fix CVE-2021-3612

cos-patch: security-high
Fixes: 182d679b2298 ("Input: joydev - prevent potential read overflow in ioctl")
Fixes: 999b874f4aa3 ("Input: joydev - validate axis/button maps before clobbering current ones")
Reported-by: Murray McAllister <murray.mcallister@gmail.com>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Alexander Larkin <avlarkin82@gmail.com>
Link: https://lore.kernel.org/r/20210620120030.1513655-1-avlarkin82@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Change-Id: Id4d5ab30af346a1574b7ad5ae2b5a6d35887117c
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/19471
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Main-Branch-Verified: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Vaibhav Rustagi <vaibhavrustagi@google.com>