Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f3c8ed73 authored by Zhang Shurong's avatar Zhang Shurong Committed by Greg Kroah-Hartman
Browse files

media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer 

[ Upstream commit aa4a447b81b84f69c1a89ad899df157f386d7636 ]

In rtl28xxu_i2c_xfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach rtl28xxu_i2c_xfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.

Similar commit:
commit 0ed554fd769a
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")

Link: https://lore.kernel.org/linux-media/tencent_3623572106754AC2F266B316798B0F6CCA05@qq.com


Signed-off-by: default avatarZhang Shurong <zhang_shurong@foxmail.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 65033ab2

drivers/media/usb/dvb-usb-v2/rtl28xxu.c

+20 −0
Original line number Diff line number Diff line
@@ -176,6 +176,10 @@ static int rtl28xxu_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], 
			ret = -EOPNOTSUPP;

			goto err_mutex_unlock;

		} else if (msg[0].addr == 0x10) {

			if (msg[0].len < 1 || msg[1].len < 1) {

				ret = -EOPNOTSUPP;

				goto err_mutex_unlock;

			}

			/* method 1 - integrated demod */

			if (msg[0].buf[0] == 0x00) {

				/* return demod page from driver cache */
@@ -189,6 +193,10 @@ static int rtl28xxu_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], 
				ret = rtl28xxu_ctrl_msg(d, &req);

			}

		} else if (msg[0].len < 2) {

			if (msg[0].len < 1) {

				ret = -EOPNOTSUPP;

				goto err_mutex_unlock;

			}

			/* method 2 - old I2C */

			req.value = (msg[0].buf[0] << 8) | (msg[0].addr << 1);

			req.index = CMD_I2C_RD;
@@ -217,8 +225,16 @@ static int rtl28xxu_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], 
			ret = -EOPNOTSUPP;

			goto err_mutex_unlock;

		} else if (msg[0].addr == 0x10) {

			if (msg[0].len < 1) {

				ret = -EOPNOTSUPP;

				goto err_mutex_unlock;

			}

			/* method 1 - integrated demod */

			if (msg[0].buf[0] == 0x00) {

				if (msg[0].len < 2) {

					ret = -EOPNOTSUPP;

					goto err_mutex_unlock;

				}

				/* save demod page for later demod access */

				dev->page = msg[0].buf[1];

				ret = 0;
@@ -231,6 +247,10 @@ static int rtl28xxu_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], 
				ret = rtl28xxu_ctrl_msg(d, &req);

			}

		} else if ((msg[0].len < 23) && (!dev->new_i2c_write)) {

			if (msg[0].len < 1) {

				ret = -EOPNOTSUPP;

				goto err_mutex_unlock;

			}

			/* method 2 - old I2C */

			req.value = (msg[0].buf[0] << 8) | (msg[0].addr << 1);

			req.index = CMD_I2C_WR;