Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a3660e06 authored by Pavel Skripkin's avatar Pavel Skripkin Committed by Greg Kroah-Hartman
Browse files

media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init 



[ Upstream commit 471bec68457aaf981add77b4f590d65dd7da1059 ]

Syzbot reported that -1 is used as array index. The problem was in
missing validation check.

hdw->unit_number is initialized with -1 and then if init table walk fails
this value remains unchanged. Since code blindly uses this member for
array indexing adding sanity check is the easiest fix for that.

hdw->workpoll initialization moved upper to prevent warning in
__flush_work.

Reported-and-tested-by: default avatar <syzbot+1a247e36149ffd709a9b@syzkaller.appspotmail.com>

Fixes: d855497e ("V4L/DVB (4228a): pvrusb2 to kernel 2.6.18")
Signed-off-by: default avatarPavel Skripkin <paskripkin@gmail.com>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 099793c6

drivers/media/usb/pvrusb2/pvrusb2-hdw.c

+5 −2
Original line number Diff line number Diff line
@@ -2561,6 +2561,11 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf, 
	} while (0);

	mutex_unlock(&pvr2_unit_mtx);



	INIT_WORK(&hdw->workpoll, pvr2_hdw_worker_poll);



	if (hdw->unit_number == -1)

		goto fail;



	cnt1 = 0;

	cnt2 = scnprintf(hdw->name+cnt1,sizeof(hdw->name)-cnt1,"pvrusb2");

	cnt1 += cnt2;
@@ -2572,8 +2577,6 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf, 
	if (cnt1 >= sizeof(hdw->name)) cnt1 = sizeof(hdw->name)-1;

	hdw->name[cnt1] = 0;



	INIT_WORK(&hdw->workpoll,pvr2_hdw_worker_poll);



	pvr2_trace(PVR2_TRACE_INIT,"Driver unit number is %d, name is %s",

		   hdw->unit_number,hdw->name);