1. Patchew
  2. linux
  3. View series

[PATCH] media: dw2102: fix OOB read on firmware size not a multiple of 64

Vasileios Almpanis posted 1 patch 1 month, 3 weeks ago 
drivers/media/usb/dvb-usb/dw2102.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
[PATCH] media: dw2102: fix OOB read on firmware size not a multiple of 64
Posted by Vasileios Almpanis 1 month, 3 weeks ago 
dw2102_load_firmware() copies the firmware into a buffer of exactly
fw->size bytes, then walks it in 0x40-byte steps while always passing
0x40 as the transfer length. When fw->size is not a multiple of 64 the
last chunk reads past the end of the allocation producing the following
splat:

  dvb-usb: downloading firmware from file 'dvb-usb-dw3101.fw'
  dw2102: start downloading DW210X firmware
  ==================================================================
  BUG: KASAN: slab-out-of-bounds in dw210x_op_rw+0xb6/0x180 drivers/media/usb/dvb-usb/dw2102.c:102
  Read of size 64 at addr ffff88802bcf2ba0 by task kworker/1:2/803
  Call Trace:
   <TASK>
   kasan_report+0x117/0x150 mm/kasan/report.c:595
   check_region_inline mm/kasan/generic.c:-1 [inline]
   kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200
   __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105
   dw210x_op_rw+0xb6/0x180 drivers/media/usb/dvb-usb/dw2102.c:102
   dw2102_load_firmware+0x2b4/0x970 drivers/media/usb/dvb-usb/dw2102.c:1906

Fix this by clamping the last chunk to the remaining bytes;

Cc: stable@vger.kernel.org
Reported-by: syzbot+f408eac9faa61d5a1927@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f408eac9faa61d5a1927
Fixes: 7fd4828f6cc5 ("V4L/DVB (8421): Adds support for Dvbworld DVB-S 2102 USB card")
Signed-off-by: Vasileios Almpanis <vasilisalmpanis@gmail.com>
---
 drivers/media/usb/dvb-usb/dw2102.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c
index 4fecf2f965e9..4e26e1776977 100644
--- a/drivers/media/usb/dvb-usb/dw2102.c
+++ b/drivers/media/usb/dvb-usb/dw2102.c
@@ -1902,9 +1902,11 @@ static int dw2102_load_firmware(struct usb_device *dev,
 	if (p) {
 		memcpy(p, fw->data, fw->size);
 		for (i = 0; i < fw->size; i += 0x40) {
+			int len = min_t(size_t, fw->size - i, 0x40);
+
 			b = (u8 *)p + i;
-			if (dw210x_op_rw(dev, 0xa0, i, 0, b, 0x40,
-					 DW210X_WRITE_MSG) != 0x40) {
+			if (dw210x_op_rw(dev, 0xa0, i, 0, b, len,
+					 DW210X_WRITE_MSG) != len) {
 				err("error while transferring firmware");
 				ret = -EINVAL;
 				break;

---
base-commit: fcaeecb8b0cd44f77d03b28de0671258d4db18f8
change-id: 20260806-dvb-307714ff6225

Best regards,
--  
Vasileios Almpanis <vasilisalmpanis@gmail.com>
Re: [PATCH] media: dw2102: fix OOB read on firmware size not a multiple of 64
Posted by Vasileios Almpanis 4 weeks, 1 day ago 
> dw2102_load_firmware() copies the firmware into a buffer of exactly
> fw->size bytes, then walks it in 0x40-byte steps while always passing
> 0x40 as the transfer length. When fw->size is not a multiple of 64 the
> last chunk reads past the end of the allocation producing the following
> splat:
> 
>   dvb-usb: downloading firmware from file 'dvb-usb-dw3101.fw'
>   dw2102: start downloading DW210X firmware
>   ==================================================================
>   BUG: KASAN: slab-out-of-bounds in dw210x_op_rw+0xb6/0x180 drivers/media/usb/dvb-usb/dw2102.c:102
>   Read of size 64 at addr ffff88802bcf2ba0 by task kworker/1:2/803
>   Call Trace:
>    <TASK>
>    kasan_report+0x117/0x150 mm/kasan/report.c:595
>    check_region_inline mm/kasan/generic.c:-1 [inline]
>    kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200
>    __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105
>    dw210x_op_rw+0xb6/0x180 drivers/media/usb/dvb-usb/dw2102.c:102
>    dw2102_load_firmware+0x2b4/0x970 drivers/media/usb/dvb-usb/dw2102.c:1906
> 
> Fix this by clamping the last chunk to the remaining bytes;
> 
Hello everyone!

A gentle ping on this patch. Is there something you would
like me to change or is the patch good to go?

Kind regards,

-- 
Vasileios Almpanis <vasilisalmpanis@gmail.com>
Re: [PATCH] media: dw2102: fix OOB read on firmware size not a multiple of 64
Posted by Vasileios Almpanis 1 month, 3 weeks ago 
On 8/6/26 7:47 PM, Vasileios Almpanis wrote:
> dw2102_load_firmware() copies the firmware into a buffer of exactly
> fw->size bytes, then walks it in 0x40-byte steps while always passing
> 0x40 as the transfer length. When fw->size is not a multiple of 64 the
> last chunk reads past the end of the allocation producing the following
> splat:
>
>    dvb-usb: downloading firmware from file 'dvb-usb-dw3101.fw'
>    dw2102: start downloading DW210X firmware
>    ==================================================================
>    BUG: KASAN: slab-out-of-bounds in dw210x_op_rw+0xb6/0x180 drivers/media/usb/dvb-usb/dw2102.c:102
>    Read of size 64 at addr ffff88802bcf2ba0 by task kworker/1:2/803
>    Call Trace:
>     <TASK>
>     kasan_report+0x117/0x150 mm/kasan/report.c:595
>     check_region_inline mm/kasan/generic.c:-1 [inline]
>     kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200
>     __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105
>     dw210x_op_rw+0xb6/0x180 drivers/media/usb/dvb-usb/dw2102.c:102
>     dw2102_load_firmware+0x2b4/0x970 drivers/media/usb/dvb-usb/dw2102.c:1906
>
> Fix this by clamping the last chunk to the remaining bytes;
I sent this patch to syzbot for testing and it reported success.
https://syzkaller.appspot.com/bug?extid=f408eac9faa61d5a1927

Tested-by: syzbot+f408eac9faa61d5a1927@syzkaller.appspotmail.com
> Cc: stable@vger.kernel.org
> Reported-by: syzbot+f408eac9faa61d5a1927@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=f408eac9faa61d5a1927
> Fixes: 7fd4828f6cc5 ("V4L/DVB (8421): Adds support for Dvbworld DVB-S 2102 USB card")
> Signed-off-by: Vasileios Almpanis <vasilisalmpanis@gmail.com>
> ---
>   drivers/media/usb/dvb-usb/dw2102.c | 6 ++++--
>   1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c
> index 4fecf2f965e9..4e26e1776977 100644
> --- a/drivers/media/usb/dvb-usb/dw2102.c
> +++ b/drivers/media/usb/dvb-usb/dw2102.c
> @@ -1902,9 +1902,11 @@ static int dw2102_load_firmware(struct usb_device *dev,
>   	if (p) {
>   		memcpy(p, fw->data, fw->size);
>   		for (i = 0; i < fw->size; i += 0x40) {
> +			int len = min_t(size_t, fw->size - i, 0x40);
> +
>   			b = (u8 *)p + i;
> -			if (dw210x_op_rw(dev, 0xa0, i, 0, b, 0x40,
> -					 DW210X_WRITE_MSG) != 0x40) {
> +			if (dw210x_op_rw(dev, 0xa0, i, 0, b, len,
> +					 DW210X_WRITE_MSG) != len) {
>   				err("error while transferring firmware");
>   				ret = -EINVAL;
>   				break;
>
> ---
> base-commit: fcaeecb8b0cd44f77d03b28de0671258d4db18f8
> change-id: 20260806-dvb-307714ff6225
>
> Best regards,
> --
> Vasileios Almpanis <vasilisalmpanis@gmail.com>
>

Patchew 2.1-devel-ea86937

© 2016 - 2026 Red Hat, Inc.