Patch "media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer()" has been added to the 6.3-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer()

to the 6.3-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     media-dvb-usb-digitv-fix-null-ptr-deref-in-digitv_i2.patch
and it can be found in the queue-6.3 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 6d1782a1d8a75373c8b547b14f43005f03c69f35
Author: Wei Chen <harperchen1110@xxxxxxxxx>
Date:   Mon Mar 13 09:50:08 2023 +0000

    media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer()
    
    [ Upstream commit 9ded5bd2a49ce3015b7c936743eec0a0e6e11f0c ]
    
    In digitv_i2c_xfer, msg is controlled by user. When msg[i].buf
    is null and msg[i].len is zero, former checks on msg[i].buf would be
    passed. Malicious data finally reach digitv_i2c_xfer. If accessing
    msg[i].buf[0] without sanity check, null ptr deref would happen. We add
    check on msg[i].len to prevent crash.
    
    Similar commit:
    commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
    
    Link: https://lore.kernel.org/linux-media/20230313095008.1039689-1-harperchen1110@xxxxxxxxx
    Signed-off-by: Wei Chen <harperchen1110@xxxxxxxxx>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/media/usb/dvb-usb/digitv.c b/drivers/media/usb/dvb-usb/digitv.c
index 2756815a780bc..32134be169148 100644
--- a/drivers/media/usb/dvb-usb/digitv.c
+++ b/drivers/media/usb/dvb-usb/digitv.c
@@ -63,6 +63,10 @@ static int digitv_i2c_xfer(struct i2c_adapter *adap,struct i2c_msg msg[],int num
 		warn("more than 2 i2c messages at a time is not handled yet. TODO.");
 
 	for (i = 0; i < num; i++) {
+		if (msg[i].len < 1) {
+			i = -EOPNOTSUPP;
+			break;
+		}
 		/* write/read request */
 		if (i+1 < num && (msg[i+1].flags & I2C_M_RD)) {
 			if (digitv_ctrl_msg(d, USB_READ_COFDM, msg[i].buf[0], NULL, 0,



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux