CVE-2020-11668: NULL Pointer Dereference (CWE-476)
value: In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandles invalid descriptors, aka CID-a246b4d54770.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.1
Published: 2020-04-09T21:15Z
Repository: https://github.com/torvalds/linux
Language: C
Files changed: drivers/media/usb/gspca/xirlink_cit.c
Commit date: 2020-03-12 17:27:07 +0100
Commit message: media: xirlink_cit: add missing descriptor sanity checks

Make sure to check that we have two alternate settings and at least one
endpoint before accessing the second altsetting structure and
dereferencing the endpoint arrays.

This specifically avoids dereferencing NULL-pointers or corrupting
memory when a device does not have the expected descriptors.

Note that the sanity check in cit_get_packet_size() is not redundant as
the driver is mixing looking up altsettings by index and by number,
which may not coincide.

Fixes: 659fefa0eb17 ("V4L/DVB: gspca_xirlink_cit: Add support for camera with a bcd version of 0.01")
Fixes: 59f8b0bf3c12 ("V4L/DVB: gspca_xirlink_cit: support bandwidth changing for devices with 1 alt setting")
Cc: stable <stable@vger.kernel.org>     # 2.6.37
Cc: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

Diff: diff --git a/drivers/media/usb/gspca/xirlink_cit.c b/drivers/media/usb/gspca/xirlink_cit.c
index 934a90bd78c2..c579b100f066 100644
--- a/drivers/media/usb/gspca/xirlink_cit.c
+++ b/drivers/media/usb/gspca/xirlink_cit.c
@@ -1440,10 +1440,13 @@ static int cit_get_packet_size(struct gspca_dev *gspca_dev)
 	if (!alt) {
 		pr_err("Couldn't get altsetting\n");
 		return -EIO;
 	}
 
+	if (alt->desc.bNumEndpoints < 1)
+		return -ENODEV;
+
 	return le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
 }
 
 /* Calculate the clockdiv giving us max fps given the available bandwidth */
 static int cit_get_clock_div(struct gspca_dev *gspca_dev)
@@ -2624,10 +2627,11 @@ static int sd_start(struct gspca_dev *gspca_dev)
 	return 0;
 }
 
 static int sd_isoc_init(struct gspca_dev *gspca_dev)
 {
+	struct usb_interface_cache *intfc;
 	struct usb_host_interface *alt;
 	int max_packet_size;
 
 	switch (gspca_dev->pixfmt.width) {
 	case 160:
@@ -2639,12 +2643,21 @@ static int sd_isoc_init(struct gspca_dev *gspca_dev)
 	default:
 		max_packet_size = 1022;
 		break;
 	}
 
+	intfc = gspca_dev->dev->actconfig->intf_cache[0];
+
+	if (intfc->num_altsetting < 2)
+		return -ENODEV;
+
+	alt = &intfc->altsetting[1];
+
+	if (alt->desc.bNumEndpoints < 1)
+		return -ENODEV;
+
 	/* Start isoc bandwidth "negotiation" at max isoc bandwidth */
-	alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1];
 	alt->endpoint[0].desc.wMaxPacketSize = cpu_to_le16(max_packet_size);
 
 	return 0;
 }
 
@@ -2663,10 +2676,13 @@ static int sd_isoc_nego(struct gspca_dev *gspca_dev)
 	default:
 		min_packet_size = 400;
 		break;
 	}
 
+	/*
+	 * Existence of altsetting and endpoint was verified in sd_isoc_init()
+	 */
 	alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1];
 	packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
 	if (packet_size <= min_packet_size)
 		return -EIO;
 

Vulnerable code: 	alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1];
Fixed code: 	if (alt->desc.bNumEndpoints < 1)
		return -ENODEV;

	struct usb_interface_cache *intfc;
	intfc = gspca_dev->dev->actconfig->intf_cache[0];

	if (intfc->num_altsetting < 2)
		return -ENODEV;

	alt = &intfc->altsetting[1];

	if (alt->desc.bNumEndpoints < 1)
		return -ENODEV;

	/*
	 * Existence of altsetting and endpoint was verified in sd_isoc_init()
	 */