Re: [PATCH] rtl28xxu: fix buffer overflow when probing Rafael Micro r820t tuner

[Antti Palosaari <crope@iki.fi>]

On 06/02/2013 09:56 PM, Gianluca Gennari wrote:
> req_r820t wants a buffer with a size of 5 bytes, but the buffer 'buf'
> has a size of 2 bytes.
>
> This patch fixes the kernel oops with the r820t driver on old kernels
> during the probe stage.
> Successfully tested on a 2.6.32 32 bit kernel (Ubuntu 10.04).
> Hopefully it will also help with the random stability issues reported
> by some user on the linux-media list.
>
> This patch and https://patchwork.kernel.org/patch/2524651/
> should go in the next 3.10-rc release, as they fix potential kernel crashes.
>
> Signed-off-by: Gianluca Gennari <gennarone@gmail.com>
> ---
>   drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
> index 22015fe..48f2e6f 100644
> --- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
> +++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
> @@ -360,7 +360,7 @@ static int rtl2832u_read_config(struct dvb_usb_device *d)
>   {
>   	struct rtl28xxu_priv *priv = d_to_priv(d);
>   	int ret;
> -	u8 buf[2];
> +	u8 buf[5];
>   	/* open RTL2832U/RTL2832 I2C gate */
>   	struct rtl28xxu_req req_gate_open = {0x0120, 0x0011, 0x0001, "\x18"};
>   	/* close RTL2832U/RTL2832 I2C gate */
>

Gianluca, could you make that probe to check chip id as usually. Read 
register 0x00 and check value 0x69. Also, please test if writing to that 
address different value will not change register value to see it is 
really chip id.

regards
Antti

-- 
http://palosaari.fi/