* [PATCH] media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861_i2c_master_xfer
@ 2023-07-08 9:29 Zhang Shurong
2023-07-10 1:45 ` Akihiro TSUKADA
0 siblings, 1 reply; 3+ messages in thread
From: Zhang Shurong @ 2023-07-08 9:29 UTC (permalink / raw)
To: crope; +Cc: mchehab, linux-media, linux-kernel, Zhang Shurong
In gl861_i2c_master_xfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach gl861_i2c_master_xfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.
Similar commit:
commit 0ed554fd769a
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
---
drivers/media/usb/dvb-usb-v2/gl861.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/usb/dvb-usb-v2/gl861.c b/drivers/media/usb/dvb-usb-v2/gl861.c
index 0c434259c36f..a552b646d407 100644
--- a/drivers/media/usb/dvb-usb-v2/gl861.c
+++ b/drivers/media/usb/dvb-usb-v2/gl861.c
@@ -97,7 +97,7 @@ static int gl861_i2c_master_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
/* XXX: I2C adapter maximum data lengths are not tested */
if (num == 1 && !(msg[0].flags & I2C_M_RD)) {
/* I2C write */
- if (msg[0].len < 2 || msg[0].len > sizeof(ctx->buf)) {
+ if (msg[0].len == 0 || msg[0].len > sizeof(ctx->buf)) {
ret = -EOPNOTSUPP;
goto err;
}
@@ -120,7 +120,7 @@ static int gl861_i2c_master_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
} else if (num == 2 && !(msg[0].flags & I2C_M_RD) &&
(msg[1].flags & I2C_M_RD)) {
/* I2C write + read */
- if (msg[0].len > 1 || msg[1].len > sizeof(ctx->buf)) {
+ if (msg[0].len != 1 || msg[1].len > sizeof(ctx->buf)) {
ret = -EOPNOTSUPP;
goto err;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861_i2c_master_xfer
2023-07-08 9:29 [PATCH] media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861_i2c_master_xfer Zhang Shurong
@ 2023-07-10 1:45 ` Akihiro TSUKADA
2023-07-10 5:13 ` Zhang Shurong
0 siblings, 1 reply; 3+ messages in thread
From: Akihiro TSUKADA @ 2023-07-10 1:45 UTC (permalink / raw)
To: Zhang Shurong, crope; +Cc: mchehab, linux-media
Is the first chunk of your patch really necessary?
`msg[0].len < 2` includes the `msg[0].len == 0` case,
so the `msg.buf == NULL && msg.len == 0` case is (seemed to me)
safely ejected as it is.
> --- a/drivers/media/usb/dvb-usb-v2/gl861.c
> +++ b/drivers/media/usb/dvb-usb-v2/gl861.c
> @@ -97,7 +97,7 @@ static int gl861_i2c_master_xfer(struct i2c_adapt
>
> er *adap, struct i2c_msg msg[],
> /* XXX: I2C adapter maximum data lengths are not tested */
> if (num == 1 && !(msg[0].flags & I2C_M_RD)) {
> /* I2C write */
> - if (msg[0].len < 2 || msg[0].len > sizeof(ctx->buf)) {
> + if (msg[0].len == 0 || msg[0].len > sizeof(ctx->buf)) {
> ret = -EOPNOTSUPP;
> goto err;
> }
regards,
akihiro
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861_i2c_master_xfer
2023-07-10 1:45 ` Akihiro TSUKADA
@ 2023-07-10 5:13 ` Zhang Shurong
0 siblings, 0 replies; 3+ messages in thread
From: Zhang Shurong @ 2023-07-10 5:13 UTC (permalink / raw)
To: Akihiro TSUKADA; +Cc: crope, mchehab, linux-media
You are right. I am very sorry for my mistake and I will send another patch fix this.
> Is the first chunk of your patch really necessary?
> `msg[0].len < 2` includes the `msg[0].len == 0` case,
> so the `msg.buf == NULL && msg.len == 0` case is (seemed to me)
> safely ejected as it is.
>
>> --- a/drivers/media/usb/dvb-usb-v2/gl861.c
>> +++ b/drivers/media/usb/dvb-usb-v2/gl861.c
>> @@ -97,7 +97,7 @@ static int gl861_i2c_master_xfer(struct i2c_adapt
>>
>> er *adap, struct i2c_msg msg[],
>> /* XXX: I2C adapter maximum data lengths are not tested */
>> if (num == 1 && !(msg[0].flags & I2C_M_RD)) {
>> /* I2C write */
>> - if (msg[0].len < 2 || msg[0].len > sizeof(ctx->buf)) {
>> + if (msg[0].len == 0 || msg[0].len > sizeof(ctx->buf)) {
>> ret = -EOPNOTSUPP;
>> goto err;
>> }
>
> regards,
> akihiro
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2023-07-10 5:22 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-07-08 9:29 [PATCH] media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861_i2c_master_xfer Zhang Shurong
2023-07-10 1:45 ` Akihiro TSUKADA
2023-07-10 5:13 ` Zhang Shurong
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).