From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Zhang Shurong <zhang_shurong@foxmail.com>,
Hans Verkuil <hverkuil-cisco@xs4all.nl>,
Sasha Levin <sashal@kernel.org>,
crope@iki.fi, mchehab@kernel.org, linux-media@vger.kernel.org
Subject: [PATCH AUTOSEL 6.4 07/25] media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861_i2c_master_xfer
Date: Fri, 8 Sep 2023 20:36:55 -0400 [thread overview]
Message-ID: <20230909003715.3579761-7-sashal@kernel.org> (raw)
In-Reply-To: <20230909003715.3579761-1-sashal@kernel.org>
From: Zhang Shurong <zhang_shurong@foxmail.com>
[ Upstream commit b97719a66970601cd3151a3e2020f4454a1c4ff6 ]
In gl861_i2c_master_xfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach gl861_i2c_master_xfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.
Similar commit:
commit 0ed554fd769a
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/dvb-usb-v2/gl861.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/usb/dvb-usb-v2/gl861.c b/drivers/media/usb/dvb-usb-v2/gl861.c
index 0c434259c36f1..c71e7b93476de 100644
--- a/drivers/media/usb/dvb-usb-v2/gl861.c
+++ b/drivers/media/usb/dvb-usb-v2/gl861.c
@@ -120,7 +120,7 @@ static int gl861_i2c_master_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
} else if (num == 2 && !(msg[0].flags & I2C_M_RD) &&
(msg[1].flags & I2C_M_RD)) {
/* I2C write + read */
- if (msg[0].len > 1 || msg[1].len > sizeof(ctx->buf)) {
+ if (msg[0].len != 1 || msg[1].len > sizeof(ctx->buf)) {
ret = -EOPNOTSUPP;
goto err;
}
--
2.40.1
next prev parent reply other threads:[~2023-09-09 0:38 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-09-09 0:36 [PATCH AUTOSEL 6.4 01/25] media: mdp3: Fix resource leaks in of_find_device_by_node Sasha Levin
2023-09-09 0:36 ` Sasha Levin
2023-09-09 0:36 ` [PATCH AUTOSEL 6.4 02/25] media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer Sasha Levin
2023-09-09 0:36 ` [PATCH AUTOSEL 6.4 03/25] media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer() Sasha Levin
2023-09-09 0:36 ` [PATCH AUTOSEL 6.4 04/25] media: af9005: Fix null-ptr-deref in af9005_i2c_xfer Sasha Levin
2023-09-09 0:36 ` [PATCH AUTOSEL 6.4 05/25] media: anysee: fix null-ptr-deref in anysee_master_xfer Sasha Levin
2023-09-09 0:36 ` [PATCH AUTOSEL 6.4 06/25] media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() Sasha Levin
2023-09-09 0:36 ` Sasha Levin [this message]
2023-09-09 0:36 ` [PATCH AUTOSEL 6.4 08/25] iio: core: Use min() instead of min_t() to make code more robust Sasha Levin
2023-09-09 0:36 ` [PATCH AUTOSEL 6.4 09/25] scsi: lpfc: Abort outstanding ELS cmds when mailbox timeout error is detected Sasha Levin
2023-09-09 0:36 ` [PATCH AUTOSEL 6.4 10/25] media: tuners: qt1010: replace BUG_ON with a regular error Sasha Levin
2023-09-09 0:36 ` [PATCH AUTOSEL 6.4 11/25] media: pci: cx23885: replace BUG with error return Sasha Levin
2023-09-09 0:37 ` [PATCH AUTOSEL 6.4 12/25] usb: cdns3: Put the cdns set active part outside the spin lock Sasha Levin
2023-09-09 0:37 ` [PATCH AUTOSEL 6.4 13/25] usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc Sasha Levin
2023-09-09 0:37 ` Sasha Levin
2023-09-09 0:37 ` [PATCH AUTOSEL 6.4 14/25] tools: iio: iio_generic_buffer: Fix some integer type and calculation Sasha Levin
2023-09-09 0:37 ` [PATCH AUTOSEL 6.4 15/25] scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() Sasha Levin
2023-09-09 0:37 ` [PATCH AUTOSEL 6.4 16/25] serial: cpm_uart: Avoid suspicious locking Sasha Levin
2023-09-09 0:37 ` [PATCH AUTOSEL 6.4 17/25] misc: open-dice: make OPEN_DICE depend on HAS_IOMEM Sasha Levin
2023-09-09 0:37 ` [PATCH AUTOSEL 6.4 18/25] workqueue: Call wq_update_unbound_numa() on all CPUs in NUMA node on CPU hotplug Sasha Levin
2023-09-09 0:37 ` [PATCH AUTOSEL 6.4 19/25] usb: ehci: add workaround for chipidea PORTSC.PEC bug Sasha Levin
2023-09-09 0:37 ` [PATCH AUTOSEL 6.4 20/25] usb: chipidea: add workaround for chipidea PEC bug Sasha Levin
2023-09-09 0:37 ` Sasha Levin
2023-09-09 0:37 ` [PATCH AUTOSEL 6.4 21/25] media: pci: ipu3-cio2: Initialise timing struct to avoid a compiler warning Sasha Levin
2023-09-09 0:37 ` [PATCH AUTOSEL 6.4 22/25] kobject: Add sanity check for kset->kobj.ktype in kset_register() Sasha Levin
2023-09-09 0:37 ` [PATCH AUTOSEL 6.4 23/25] interconnect: Fix locking for runpm vs reclaim Sasha Levin
2023-09-09 0:37 ` [PATCH AUTOSEL 6.4 24/25] usb: cdc-acm: move ldisc dcd notification outside of acm's read lock Sasha Levin
2023-09-11 9:19 ` Johan Hovold
2023-09-18 16:47 ` Sasha Levin
2023-09-09 0:37 ` [PATCH AUTOSEL 6.4 25/25] riscv: Add CFI error handling Sasha Levin
2023-09-09 0:37 ` Sasha Levin
2023-09-09 3:33 ` Palmer Dabbelt
2023-09-09 3:33 ` Palmer Dabbelt
2023-09-11 15:03 ` Sami Tolvanen
2023-09-11 15:03 ` Sami Tolvanen
2023-09-18 16:50 ` Sasha Levin
2023-09-18 16:50 ` Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230909003715.3579761-7-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=crope@iki.fi \
--cc=hverkuil-cisco@xs4all.nl \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab@kernel.org \
--cc=stable@vger.kernel.org \
--cc=zhang_shurong@foxmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.