From nobody Sun Apr 5 16:36:20 2026 Received: from mail-ot1-f69.google.com (mail-ot1-f69.google.com [209.85.210.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B5BAE3845A1 for ; Mon, 23 Mar 2026 23:28:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.69 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774308504; cv=none; b=CwnsqU24oBX0ugTwlWc2rEoG5Be8KVoGj3rlUQip2+InHkx4b9b/RDaQZBjPbyCDWpFdXM2J1bTLKoaSbummyyTU9odPZ2w66akpoOvRGYe79x0qtX1tnIOnfC9rG0Mhkl2wn2/Q3Nvohy5yOO2sZJpXiux5XuZP3UK4XtKoWQo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774308504; c=relaxed/simple; bh=wn23x6WzgEVACVPaF5FRlDw72fZsDqZp1ZmTg+CAFDU=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=ZXLLVjFky1xqJHEOsugy2e3Ic9Shg3xOkV64GwkQEDhGLF5LZ8VMQyemLNlKI1DGpkgZ7/LPs/Ev4BcesHcKdkjdO921u+7RKCUbCNbZ1ls6ZBFu4o86mYkaiFVoZNCXJlXBvD5IB9JGClZH+URrSONEWWddKpyiNSuH1YCwoXA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.210.69 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-ot1-f69.google.com with SMTP id 46e09a7af769-7d7fd0be5e3so23651652a34.0 for ; Mon, 23 Mar 2026 16:28:22 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774308502; x=1774913302; h=to:from:subject:message-id:in-reply-to:date:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=qNYxGV7gcHUdw5OcZTx3WvS/3S1fiCMi/WvTgzIUlFY=; b=UgbAECjEHuwIbM9JQ6WBMAXRqjRLzFAFMNTm6eQzmqjAL2bvKmbuQlOlUH4toVjW6r /mqWFZClxfkrszunx/nxjfDi44gkmW7TEhmArKmSoMhzVvy/FRwk8FhJabpZuygiPLyQ jQ8UhEEBP21Ritn1otQuzi5xpLSWc7eIFaTrVM814ekgcP+nNd2QJbwVTnpL9CALkh8u Ax7e+xTEaoRqfFnfT11AkqSvS4zVoKul8749KbJSokJtflH7Lyq6UNQfeVWiJWs/3Zul 3oav8p0mjq2mkmdCkCLi8vZOAgYHVwWn/Xiz5nSAFSc0mJ3o71BMs3EoNkFlaqAsEiG/ S+Zg== X-Gm-Message-State: AOJu0YwAQQQ5FpVkybccbnikNoRZUSiTpLIr02B33rdCQcVSOB3Wk/lx UQxXhv4NfhhdSPYL89vRgT4rnrEuwIvgJdJstFdchZj1z5jwxoJE6+VadT6i46fZufIoPpLVbdJ ubNCKby1mhLtW4uHvXAegWoBP6tNIPtHyM0GjSqERxcMPIWd67OEwLG/ZTyQ= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a4a:de43:0:b0:67d:e5c5:3db3 with SMTP id 006d021491bc7-67df5d1534emr925152eaf.15.1774308501794; Mon, 23 Mar 2026 16:28:21 -0700 (PDT) Date: Mon, 23 Mar 2026 16:28:21 -0700 In-Reply-To: <69c19ef0.050a0220.3bf4de.00aa.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <69c1cc95.050a0220.3bf4de.00ab.GAE@google.com> Subject: Forwarded: [PATCH] media: ec168: fix slab-out-of-bounds in ec168_i2c_xfer From: syzbot To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: [PATCH] media: ec168: fix slab-out-of-bounds in ec168_i2c_xfer Author: kartikey406@gmail.com #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.gi= t master The WRITE_DEMOD path in ec168_i2c_xfer() checks msg[i].len < 1 before accessing the buffer, but then reads both buf[0] (register) and buf[1] (value). If userspace supplies a 1-byte I2C message, the read of buf[1] goes out of bounds, triggering a KASAN slab-out-of-bounds error. Fix by requiring msg[i].len >=3D 2 in the WRITE_DEMOD path before accessing the buffer. Fixes: a6dcefcc08ec ("media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168= _i2c_xfer()") Reported-by: syzbot+64485d3659c4c07111b4@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3D64485d3659c4c07111b4 Signed-off-by: Deepanshu Kartikey --- drivers/media/usb/dvb-usb-v2/ec168.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/usb/dvb-usb-v2/ec168.c b/drivers/media/usb/dvb-u= sb-v2/ec168.c index 973b32356b17..ebfb02826b20 100644 --- a/drivers/media/usb/dvb-usb-v2/ec168.c +++ b/drivers/media/usb/dvb-usb-v2/ec168.c @@ -135,7 +135,7 @@ static int ec168_i2c_xfer(struct i2c_adapter *adap, str= uct i2c_msg msg[], } } else { if (msg[i].addr =3D=3D ec168_ec100_config.demod_address) { - if (msg[i].len < 1) { + if (msg[i].len < 2) { i =3D -EOPNOTSUPP; break; } --=20 2.43.0