Re: [PATCH] Input: joydev - prevent potential write out of bounds in ioctl

[Denis Efremov]

Hi,

On 6/20/21 3:00 PM, Alexander Larkin wrote:
>     The problem is that the check of user input values that is just
>     before the fixed line of code is for the part of first values
>     (before len or before len/2), but then the usage of all the values
>     including i >= len (or i >= len/2) could be.
>     Since the resulted array of values inited by default with some
>     good values, the fix is to ignore out of bounds values and
>     just to use only correct input values by user.
>     Originally detected by Murray with this simple poc
>     (If you run the following as an unprivileged user on a default install
>      it will instantly panic the system:
> 
> int main(void) {
> 	int fd, ret;
> 	unsigned int buffer[10000];
> 
> 	fd = open("/dev/input/js0", O_RDONLY);
> 	if (fd == -1)
> 		printf("Error opening file\n");
> 
> 	ret = ioctl(fd, JSIOCSBTNMAP & ~IOCSIZE_MASK, &buffer);
> 	printf("%d\n", ret);
> }
> 
> Fixes: 182d679b2298 ("Input: joydev - prevent potential read overflow in ioctl")


I'm not sure that this is a proper fixes tag. Seems like the bug is in the
code since the first commit (1da177e4c3f4). Maybe it's possible to add 2 fixes
tags just to notify developers that this bug is older than a 182d679b2298
partial fix.

> Reported-by: Murray McAllister <murray.mcallister@xxxxxxxxx>
> Signed-off-by: Alexander Larkin <avlarkin82@xxxxxxxxx>
> ---
>  drivers/input/joydev.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
> index da8963a9f044..1aa067d4a3e8 100644
> --- a/drivers/input/joydev.c
> +++ b/drivers/input/joydev.c
> @@ -464,7 +464,7 @@ static int joydev_handle_JSIOCSAXMAP(struct joydev *joydev,
>  
>  	memcpy(joydev->abspam, abspam, len);
>  
> -	for (i = 0; i < joydev->nabs; i++)
> +	for (i = 0; i < len && i < joydev->nabs; i++)
>  		joydev->absmap[joydev->abspam[i]] = i;
>  
>   out:
> @@ -498,7 +498,7 @@ static int joydev_handle_JSIOCSBTNMAP(struct joydev *joydev,
>  
>  	memcpy(joydev->keypam, keypam, len);
>  
> -	for (i = 0; i < joydev->nkey; i++)
> +	for (i = 0; i < (len / 2) && i < joydev->nkey; i++)
>  		joydev->keymap[keypam[i] - BTN_MISC] = i;
>  
>   out:
>