[PATCH] media: dvb-core: purge unsafe ULE debug and fix pre-existing vulnerabilities

[PATCH] media: dvb-core: purge unsafe ULE debug and fix pre-existing vulnerabilities

[Breno Rodrigues Alves]

This commit completely removes the unmaintained DVB_ULE_DEBUG code block from
dvb_net.c and its Kconfig definition to eliminate lockless race conditions
and cleans up the unused function signature parameter in dvb_net_ule_check_crc()
to resolve compilation failures.

Additionally, this patch addresses two pre-existing critical security issues:
1. Fixes a Use-After-Free (UAF) vulnerability in dvb_net_remove_if() by
   invoking unregister_netdev() before flushing the workqueues, ensuring no
   new callbacks can queue tasks after flushes.
2. Fixes an Out-of-Bounds (OOB) memory read vulnerability in the ULE extension
   header parsing loop by introducing a strict bounds check against the skb
   tail pointer.

Assisted-by: OpenCode AI
Signed-off-by: Breno Rodrigues Alves <breno3011alves@gmail.com>
---
 drivers/media/dvb-core/Kconfig   | 11 --------
 drivers/media/dvb-core/dvb_net.c | 57 ++++++++++++++------------------
 2 files changed, 25 insertions(+), 43 deletions(-)

diff --git a/drivers/media/dvb-core/Kconfig b/drivers/media/dvb-core/Kconfig
index 8b3f2d53c..c6a97add8 100644
--- a/drivers/media/dvb-core/Kconfig
+++ b/drivers/media/dvb-core/Kconfig
@@ -67,14 +67,3 @@ config DVB_DEMUX_SECTION_LOSS_LOG
 
          If you are unsure about this, say N here.
 
-config DVB_ULE_DEBUG
-       bool "Enable DVB net ULE packet debug messages"
-       depends on DVB_CORE
-       help
-         Enable extra log messages meant to detect problems while
-         handling DVB network ULE packet loss inside the Kernel.
-
-         Should not be enabled on normal cases, as logs can
-         be very verbose.
-
-         If you are unsure about this, say N here.
diff --git a/drivers/media/dvb-core/dvb_net.c b/drivers/media/dvb-core/dvb_net.c
index a2159b2bc..5060b8866 100644
--- a/drivers/media/dvb-core/dvb_net.c
+++ b/drivers/media/dvb-core/dvb_net.c
@@ -68,19 +68,6 @@ static inline __u32 iov_crc32( __u32 c, struct kvec *iov, unsigned int cnt )
 
 #define DVB_NET_MULTICAST_MAX 10
 
-#ifdef DVB_ULE_DEBUG
-/*
- * The code inside DVB_ULE_DEBUG keeps a history of the
- * last 100 TS cells processed.
- */
-static unsigned char ule_hist[100*TS_SZ] = { 0 };
-static unsigned char *ule_where = ule_hist, ule_dump;
-
-static void hexdump(const unsigned char *buf, unsigned short len)
-{
-       print_hex_dump_debug("", DUMP_PREFIX_OFFSET, 16, 1, buf, len, true);
-}
-#endif
 
 struct dvb_net_priv {
        int in_use;
@@ -320,16 +307,6 @@ static int dvb_net_ule_new_ts_cell(struct dvb_net_ule_handle *h)
 {
        /* We are about to process a new TS cell. */
 
-#ifdef DVB_ULE_DEBUG
-       if (ule_where >= &ule_hist[100*TS_SZ])
-               ule_where = ule_hist;
-       memcpy(ule_where, h->ts, TS_SZ);
-       if (ule_dump) {
-               hexdump(ule_where, TS_SZ);
-               ule_dump = 0;
-       }
-       ule_where += TS_SZ;
-#endif
 
        /*
         * Check TS h->error conditions: sync_byte, transport_error_indicator,
@@ -382,6 +359,10 @@ static int handle_one_ule_extension(struct dvb_net_ule_handle *h, int ext_len)
 static int handle_ule_extensions(struct dvb_net_ule_handle *h)
 {
 	int ext_len;
+	struct sk_buff *skb = h->priv->rx_skb;
+	unsigned char *tail = skb_tail_pointer(skb);
+
+	h->ule_next_hdr = h->from_where;
 
 	do {
 		ext_len = h->ule_sndu_type;
@@ -391,6 +372,11 @@ static int handle_ule_extensions(struct dvb_net_ule_handle *h)
 			ext_len = handle_one_ule_extension(h, ext_len);
 			if (ext_len < 0)
 				return ext_len;
+
+			/* Prevent Out-of-Bounds read from malformed long extension headers */
+			if (h->ule_next_hdr + ext_len > tail)
+				return -EINVAL;
+
 			h->ule_next_hdr += ext_len;
 			if (h->ule_next_hdr == tail)
 				return -EINVAL;
@@ -632,7 +618,6 @@ static void dvb_net_ule_check_crc(struct dvb_net_ule_handle *h,
-                                 struct kvec *iov,
                                  __u32 ule_crc, __u32 expected_crc)
 {
        pr_warn("%s: CRC32 check FAILED: %08x <> %08x\n",
@@ -659,23 +644,6 @@ static void dvb_net_ule_check_crc(struct dvb_net_ule_handle *h,
                        h->ts_remain > 2 ?
                                *(unsigned short *)h->from_where : 0);
 
-       #ifdef DVB_ULE_DEBUG
-               hexdump(iov[0].iov_base, iov[0].iov_len);
-               hexdump(iov[1].iov_base, iov[1].iov_len);
-               hexdump(iov[2].iov_base, iov[2].iov_len);
-
-               if (ule_where == ule_hist) {
-                       hexdump(&ule_hist[98*TS_SZ], TS_SZ);
-                       hexdump(&ule_hist[99*TS_SZ], TS_SZ);
-               } else if (ule_where == &ule_hist[TS_SZ]) {
-                       hexdump(&ule_hist[99*TS_SZ], TS_SZ);
-                       hexdump(ule_hist, TS_SZ);
-               } else {
-                       hexdump(ule_where - TS_SZ - TS_SZ, TS_SZ);
-                       hexdump(ule_where - TS_SZ, TS_SZ);
-               }
-               ule_dump = 1;
-       #endif
 
                h->dev->stats.rx_errors++;
                h->dev->stats.rx_crc_errors++;
@@ -843,7 +811,7 @@ static void dvb_net_ule(struct net_device *dev, const u8 *buf, size_t buf_len)
                                       *(tail - 2) << 8 |
                                       *(tail - 1);
 
-                       dvb_net_ule_check_crc(&h, iov, ule_crc, expected_crc);
+                       dvb_net_ule_check_crc(&h, ule_crc, expected_crc);
 
                        /* Prepare for next SNDU. */
                        reset_ule(h.priv);
@@ -1214,9 +1182,9 @@ static void dvb_net_remove_if(struct dvb_net *dvbnet, unsigned int num)
        priv->in_use = 0;
        net = priv->net;
 
+       unregister_netdev(net);
        flush_work(&priv->set_multicast_list_wq);
        flush_work(&priv->restart_net_feed_wq);
        pr_info("removed network interface %s\n", net->name);
-       unregister_netdev(net);
        free_netdev(net);
 }
-- 
2.43.0