Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fa58d9db authored by Zhang Shurong's avatar Zhang Shurong Committed by Greg Kroah-Hartman
Browse files

media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer 



[ Upstream commit 7bf744f2de0a848fb1d717f5831b03db96feae89 ]

In af9035_i2c_master_xfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach af9035_i2c_master_xfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.

Similar commit:
commit 0ed554fd769a
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")

Signed-off-by: default avatarZhang Shurong <zhang_shurong@foxmail.com>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
[ moved variable declaration to fix build issues in older kernels - gregkh ]
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 3cc4c2f6

drivers/media/usb/dvb-usb-v2/af9035.c

+8 −6
Original line number Diff line number Diff line
@@ -284,6 +284,7 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap, 
	struct dvb_usb_device *d = i2c_get_adapdata(adap);

	struct state *state = d_to_priv(d);

	int ret;

	u32 reg;



	if (mutex_lock_interruptible(&d->i2c_mutex) < 0)

		return -EAGAIN;
@@ -336,8 +337,10 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap, 
			ret = -EOPNOTSUPP;

		} else if ((msg[0].addr == state->af9033_i2c_addr[0]) ||

			   (msg[0].addr == state->af9033_i2c_addr[1])) {

			if (msg[0].len < 3 || msg[1].len < 1)

				return -EOPNOTSUPP;

			/* demod access via firmware interface */

			u32 reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |

			reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |

					msg[0].buf[2];



			if (msg[0].addr == state->af9033_i2c_addr[1])
@@ -395,17 +398,16 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap, 
			ret = -EOPNOTSUPP;

		} else if ((msg[0].addr == state->af9033_i2c_addr[0]) ||

			   (msg[0].addr == state->af9033_i2c_addr[1])) {

			if (msg[0].len < 3)

				return -EOPNOTSUPP;

			/* demod access via firmware interface */

			u32 reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |

			reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |

					msg[0].buf[2];



			if (msg[0].addr == state->af9033_i2c_addr[1])

				reg |= 0x100000;



			ret = (msg[0].len >= 3) ? af9035_wr_regs(d, reg,

							         &msg[0].buf[3],

							         msg[0].len - 3)

					        : -EOPNOTSUPP;

			ret = af9035_wr_regs(d, reg, &msg[0].buf[3], msg[0].len - 3);

		} else {

			/* I2C write */

			u8 buf[MAX_XFER_SIZE];