Re: [PATCH] rtl28xxu: fix buffer overflow when probing Rafael Micro r820t tuner

[Antti Palosaari <crope@iki.fi>]

On 06/02/2013 10:51 PM, Gianluca Gennari wrote:
> Il 02/06/2013 21:30, Antti Palosaari ha scritto:
>> On 06/02/2013 09:56 PM, Gianluca Gennari wrote:
>>> req_r820t wants a buffer with a size of 5 bytes, but the buffer 'buf'
>>> has a size of 2 bytes.
>>>
>>> This patch fixes the kernel oops with the r820t driver on old kernels
>>> during the probe stage.
>>> Successfully tested on a 2.6.32 32 bit kernel (Ubuntu 10.04).
>>> Hopefully it will also help with the random stability issues reported
>>> by some user on the linux-media list.
>>>
>>> This patch and https://patchwork.kernel.org/patch/2524651/
>>> should go in the next 3.10-rc release, as they fix potential kernel
>>> crashes.
>>>
>>> Signed-off-by: Gianluca Gennari <gennarone@gmail.com>
>>> ---
>>>    drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 2 +-
>>>    1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
>>> b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
>>> index 22015fe..48f2e6f 100644
>>> --- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
>>> +++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
>>> @@ -360,7 +360,7 @@ static int rtl2832u_read_config(struct
>>> dvb_usb_device *d)
>>>    {
>>>        struct rtl28xxu_priv *priv = d_to_priv(d);
>>>        int ret;
>>> -    u8 buf[2];
>>> +    u8 buf[5];
>>>        /* open RTL2832U/RTL2832 I2C gate */
>>>        struct rtl28xxu_req req_gate_open = {0x0120, 0x0011, 0x0001,
>>> "\x18"};
>>>        /* close RTL2832U/RTL2832 I2C gate */
>>>
>>
>> Gianluca, could you make that probe to check chip id as usually. Read
>> register 0x00 and check value 0x69. Also, please test if writing to that
>> address different value will not change register value to see it is
>> really chip id.
>>
>> regards
>> Antti
>>
>
> Hi Antti,
> surely it makes sense. I will not have the time to check it until the
> end of the coming week, so if someone else wants to do it in advance I
> will not take offence ;-)
>
> Regards,
> Gianluca
>

Yeah. I would not like to extend that buf to 5 as it is not "proper" 
solution. Current check is more like just a check that there is some 
chip on that I2C address. Reading one byte makes as much sense as 
reading 5 bytes. Maybe Mauro has added that probe "lets implement it 
later" and then forget...

Northern part of Finland has has very warm weather now in two weeks and 
I haven't found any time to code now :D Crazy, 25-30 C degrees every 
day, hottest place in whole Europe :] I really hope it will go back to 
normal rainy and cold weather soon that I can jump back to coding...

regards
Antti

-- 
http://palosaari.fi/