archive mirror
 help / color / mirror / Atom feed
From: Phong Tran <>
Subject: Analyze syzbot report technisat_usb2_rc_query KASAN
Date: Tue, 2 Jul 2019 07:49:26 +0700	[thread overview]
Message-ID: <> (raw)


I did a checking for this report of syzbot [1]
 From the call stack of dump log:

There shows that a problem within technisat_usb2_get_ir()

BUG: KASAN: slab-out-of-bounds in technisat_usb2_get_ir 
drivers/media/usb/dvb-usb/technisat-usb2.c:664 [inline]
BUG: KASAN: slab-out-of-bounds in technisat_usb2_rc_query+0x5fa/0x660 
Read of size 1 at addr ffff8880a8791ea8 by task kworker/0:1/12

Take a look into while loop in technisat_usb2_get_ir().
I recognized that a problem. The loop will not break out with the 
condition doesn't reach. Then "b++" will go wrong and buffer will be 

while (1) {
	if (*b == 0xff) {
		ev.pulse = 0;
		ev.duration = 888888*2;
		ir_raw_event_store(d->rc_dev, &ev);

I would propose changing the loop condition by checking the address of 
the buffer. If acceptable, I will send this patch to the mailing-list.

-       while (1) {
+       while (b != (buf + 63)) {

Tested with syzbot, result is good [2].



             reply	other threads:[~2019-07-02  0:49 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-07-02  0:49 Phong Tran [this message]
2019-07-02  4:45 ` [Linux-kernel-mentees] Analyze syzbot report technisat_usb2_rc_query KASAN Greg KH
2019-07-02 14:06   ` Phong Tran

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).