Vulnerability: drivers/media/usb/dvb-usb/cxusb.c in the Linux kernel 4.9.x and 4.10.x before 4.10.12 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.
Vulnerability ID: CVE-2017-8063
CWE: CWE-119
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2017-04-23
File: drivers/media/usb/dvb-usb/cxusb.c
Commit message: [media] cxusb: Use a dma capable buffer also for reading

Commit 17ce039b4e54 ("[media] cxusb: don't do DMA on stack")
added a kmalloc'ed bounce buffer for writes, but missed to do the same
for reads. As the read only happens after the write is finished, we can
reuse the same buffer.

As dvb_usb_generic_rw handles a read length of 0 by itself, avoid calling
it using the dvb_usb_generic_read wrapper function.

Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Commit author: Stefan Brüns

Vulnerable version (before fix):
 static int cxusb_ctrl_msg(struct dvb_usb_device *d, 			  u8 cmd, u8 *wbuf, int wlen, u8 *rbuf, int rlen) { 	struct cxusb_state *st = d->priv; 	int ret, wo;  	if (1 + wlen > MAX_XFER_SIZE) { 		warn("i2c wr: len=%d is too big!\n", wlen); 		return -EOPNOTSUPP; 	}  	wo = (rbuf == NULL || rlen == 0); /* write-only */  	mutex_lock(&d->data_mutex); 	st->data[0] = cmd; 	memcpy(&st->data[1], wbuf, wlen); 	if (wo) 		ret = dvb_usb_generic_write(d, st->data, 1 + wlen); 	else 		ret = dvb_usb_generic_rw(d, st->data, 1 + wlen, 					 rbuf, rlen, 0);  	mutex_unlock(&d->data_mutex); 	return ret;

Fixed version (after fix):
 static int cxusb_ctrl_msg(struct dvb_usb_device *d, 			  u8 cmd, u8 *wbuf, int wlen, u8 *rbuf, int rlen) { 	struct cxusb_state *st = d->priv; 	int ret;  	if (1 + wlen > MAX_XFER_SIZE) { 		warn("i2c wr: len=%d is too big!\n", wlen); 		return -EOPNOTSUPP; 	}  	if (rlen > MAX_XFER_SIZE) { 		warn("i2c rd: len=%d is too big!\n", rlen); 		return -EOPNOTSUPP; 	}  	mutex_lock(&d->data_mutex); 	st->data[0] = cmd; 	memcpy(&st->data[1], wbuf, wlen); 	ret = dvb_usb_generic_rw(d, st->data, 1 + wlen, st->data, rlen, 0); 	if (!ret && rbuf && rlen) 		memcpy(rbuf, st->data, rlen);  	mutex_unlock(&d->data_mutex); 	return ret;

Patch:
patch: @@ -59,23 +59,24 @@ static int cxusb_ctrl_msg(struct dvb_usb_device *d,
 			  u8 cmd, u8 *wbuf, int wlen, u8 *rbuf, int rlen)
 {
 	struct cxusb_state *st = d->priv;
-	int ret, wo;
+	int ret;
 
 	if (1 + wlen > MAX_XFER_SIZE) {
 		warn("i2c wr: len=%d is too big!\n", wlen);
 		return -EOPNOTSUPP;
 	}
 
-	wo = (rbuf == NULL || rlen == 0); /* write-only */
+	if (rlen > MAX_XFER_SIZE) {
+		warn("i2c rd: len=%d is too big!\n", rlen);
+		return -EOPNOTSUPP;
+	}
 
 	mutex_lock(&d->data_mutex);
 	st->data[0] = cmd;
 	memcpy(&st->data[1], wbuf, wlen);
-	if (wo)
-		ret = dvb_usb_generic_write(d, st->data, 1 + wlen);
-	else
-		ret = dvb_usb_generic_rw(d, st->data, 1 + wlen,
-					 rbuf, rlen, 0);
+	ret = dvb_usb_generic_rw(d, st->data, 1 + wlen, st->data, rlen, 0);
+	if (!ret && rbuf && rlen)
+		memcpy(rbuf, st->data, rlen);
 
 	mutex_unlock(&d->data_mutex);
 	return ret;
path: drivers/media/usb/dvb-usb/cxusb.c