[PATCH] media: dvb-usb-v2: af9015: reject invalid TS mode from EEPROM

[PATCH] media: dvb-usb-v2: af9015: reject invalid TS mode from EEPROM

[Jay Vadayath]

af9015_read_config() reads a "TS mode" byte from the device EEPROM and
stores it in state->dual_mode without any validation. That value is
later used as the upper bound of a loop that indexes the fixed-size
af9013_pdata[2] and mt2060_if1[2] arrays in state, so any value greater
than 1 walks past the end of both arrays and corrupts memory.

The EEPROM contents are attacker-controlled for a hostile or emulated
USB device (raw-gadget can synthesise arbitrary control-endpoint
replies), so this is reachable from an unprivileged user with access to
/dev/raw-gadget. A device returning TS_MODE=0xFF drives dual_mode=255
and produces a slab-out-of-bounds write reported by KASAN:

  BUG: KASAN: slab-out-of-bounds in af9015_read_config+0xc5a/0xd40
  Write of size 4 at addr ffff8880052b1980 by task kworker/1:3/86
  Call Trace:
   dump_stack_lvl+0x64/0x80
   print_report+0xce/0x620
   kasan_report+0xec/0x120
   af9015_read_config+0xc5a/0xd40
   dvb_usbv2_probe+0x561/0x3900
   usb_probe_interface+0x279/0x980
   really_probe+0x1c8/0x950
   __driver_probe_device+0x1a5/0x430
   driver_probe_device+0x45/0xd0
   __device_attach_driver+0x156/0x230
   bus_for_each_drv+0x10f/0x190
   __device_attach+0x18e/0x3b0
   device_initial_probe+0x78/0xa0
   bus_probe_device+0x57/0x130
   device_add+0xe2c/0x1530

Reject TS mode values other than 0 or 1 with -EINVAL so the probe fails
cleanly instead of scribbling over slab memory.

This bug was discovered by Artiphishell's vTriage pipeline, which
generated a userspace raw-gadget reproducer that reliably triggers the
KASAN report on an unpatched kernel. The fix below was drafted with the
Claude coding assistant; a userspace reproducer is available on
request.

Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Jay Vadayath <jay@artiphishell.com>

---
 drivers/media/usb/dvb-usb-v2/af9015.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

--- a/drivers/media/usb/dvb-usb-v2/af9015.c
+++ b/drivers/media/usb/dvb-usb-v2/af9015.c
@@ -403,6 +403,17 @@ static int af9015_read_config(struct dvb_usb_device *d)
 	if (ret)
 		goto error;

+	/*
+	 * TS mode selects one (0) or two (1) receivers. The value is used as
+	 * the upper bound of a loop that indexes the fixed-size af9013_pdata[2]
+	 * and mt2060_if1[2] arrays, so a corrupted/hostile EEPROM byte larger
+	 * than 1 would cause an out-of-bounds write. Reject such values.
+	 */
+	if (val > 1) {
+		dev_err(&intf->dev, "invalid ts mode %02x\n", val);
+		ret = -EINVAL;
+		goto error;
+	}
 	state->dual_mode = val;
 	dev_dbg(&intf->dev, "ts mode %02x\n", state->dual_mode);