Patch "media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer()" has been added to the 5.4-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer()

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     media-dvb-usb-az6027-fix-three-null-ptr-deref-in-az6.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit fbd9de3dd292463530f25aec36b4b3e073afdcd1
Author: Wei Chen <harperchen1110@xxxxxxxxx>
Date:   Fri Mar 10 16:56:04 2023 +0000

    media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer()
    
    [ Upstream commit 858e97d7956d17a2cb56a9413468704a4d5abfe1 ]
    
    In az6027_i2c_xfer, msg is controlled by user. When msg[i].buf is null,
    commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in
    az6027_i2c_xfer()") fix the null-ptr-deref bug when msg[i].addr is 0x99.
    However, null-ptr-deref also happens when msg[i].addr is 0xd0 and 0xc0.
    We add check on msg[i].len to prevent null-ptr-deref.
    
    Link: https://lore.kernel.org/linux-media/20230310165604.3093483-1-harperchen1110@xxxxxxxxx
    Signed-off-by: Wei Chen <harperchen1110@xxxxxxxxx>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/media/usb/dvb-usb/az6027.c b/drivers/media/usb/dvb-usb/az6027.c
index ffc0db67d4d68..2b56393d10008 100644
--- a/drivers/media/usb/dvb-usb/az6027.c
+++ b/drivers/media/usb/dvb-usb/az6027.c
@@ -988,6 +988,10 @@ static int az6027_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int n
 			/* write/read request */
 			if (i + 1 < num && (msg[i + 1].flags & I2C_M_RD)) {
 				req = 0xB9;
+				if (msg[i].len < 1) {
+					i = -EOPNOTSUPP;
+					break;
+				}
 				index = (((msg[i].buf[0] << 8) & 0xff00) | (msg[i].buf[1] & 0x00ff));
 				value = msg[i].addr + (msg[i].len << 8);
 				length = msg[i + 1].len + 6;
@@ -1001,6 +1005,10 @@ static int az6027_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int n
 
 				/* demod 16bit addr */
 				req = 0xBD;
+				if (msg[i].len < 1) {
+					i = -EOPNOTSUPP;
+					break;
+				}
 				index = (((msg[i].buf[0] << 8) & 0xff00) | (msg[i].buf[1] & 0x00ff));
 				value = msg[i].addr + (2 << 8);
 				length = msg[i].len - 2;
@@ -1026,6 +1034,10 @@ static int az6027_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int n
 			} else {
 
 				req = 0xBD;
+				if (msg[i].len < 1) {
+					i = -EOPNOTSUPP;
+					break;
+				}
 				index = msg[i].buf[0] & 0x00FF;
 				value = msg[i].addr + (1 << 8);
 				length = msg[i].len - 1;



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux