The WRITE_DEMOD path in ec168_i2c_xfer() checks msg[i].len < 1
before accessing the buffer, but then reads both buf[0] (register)
and buf[1] (value). If userspace supplies a 1-byte I2C message,
the read of buf[1] goes out of bounds, triggering a KASAN
slab-out-of-bounds error.
Fix by checking msg[i].len < 2 and returning -EOPNOTSUPP if the
buffer is too short to contain both register and value bytes.
Fixes: a6dcefcc08ec ("media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer()")
Cc: stable@vger.kernel.org
Reported-by: syzbot+64485d3659c4c07111b4@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=64485d3659c4c07111b4
Tested-by: syzbot+64485d3659c4c07111b4@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
Changes in v2:
- Fix author email case (Kartikey406 -> kartikey406)
- Add Cc: stable@vger.kernel.org as the Fixes tag points
to a commit present in the stable tree
---
drivers/media/usb/dvb-usb-v2/ec168.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/usb/dvb-usb-v2/ec168.c b/drivers/media/usb/dvb-usb-v2/ec168.c
index 973b32356b17..ebfb02826b20 100644
--- a/drivers/media/usb/dvb-usb-v2/ec168.c
+++ b/drivers/media/usb/dvb-usb-v2/ec168.c
@@ -135,7 +135,7 @@ static int ec168_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
}
} else {
if (msg[i].addr == ec168_ec100_config.demod_address) {
- if (msg[i].len < 1) {
+ if (msg[i].len < 2) {
i = -EOPNOTSUPP;
break;
}
--
2.43.0