Unverified Commit 2a57fb98 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!11533 Fix CVE-2023-52915 

Merge Pull Request from: @ci-robot 
 
PR sync from: Ye Bin <yebin10@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/QTWE3AFBXFHLCJQVYYYXVDE6RNF6NELT/ 
Hans Verkuil (1):
  media: dvb-usb-v2: af9035: fix missing unlock

Zhang Shurong (1):
  media: dvb-usb-v2: af9035: Fix null-ptr-deref in
    af9035_i2c_master_xfer


-- 
2.34.1
 
https://gitee.com/openeuler/kernel/issues/IAPHC5 
 
Link:https://gitee.com/openeuler/kernel/pulls/11533

 

Reviewed-by: default avatarYang Yingliang <yangyingliang@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 33b1e51b 2754208a

drivers/media/usb/dvb-usb-v2/af9035.c

+13 −6
Original line number Diff line number Diff line
@@ -269,6 +269,7 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap, 
	struct dvb_usb_device *d = i2c_get_adapdata(adap);

	struct state *state = d_to_priv(d);

	int ret;

	u32 reg;



	if (mutex_lock_interruptible(&d->i2c_mutex) < 0)

		return -EAGAIN;
@@ -321,8 +322,12 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap, 
			ret = -EOPNOTSUPP;

		} else if ((msg[0].addr == state->af9033_i2c_addr[0]) ||

			   (msg[0].addr == state->af9033_i2c_addr[1])) {

			if (msg[0].len < 3 || msg[1].len < 1) {

				ret = -EOPNOTSUPP;

				goto unlock;

			}

			/* demod access via firmware interface */

			u32 reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |

			reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |

					msg[0].buf[2];



			if (msg[0].addr == state->af9033_i2c_addr[1])
@@ -380,17 +385,18 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap, 
			ret = -EOPNOTSUPP;

		} else if ((msg[0].addr == state->af9033_i2c_addr[0]) ||

			   (msg[0].addr == state->af9033_i2c_addr[1])) {

			if (msg[0].len < 3) {

				ret = -EOPNOTSUPP;

				goto unlock;

			}

			/* demod access via firmware interface */

			u32 reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |

			reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |

					msg[0].buf[2];



			if (msg[0].addr == state->af9033_i2c_addr[1])

				reg |= 0x100000;



			ret = (msg[0].len >= 3) ? af9035_wr_regs(d, reg,

							         &msg[0].buf[3],

							         msg[0].len - 3)

					        : -EOPNOTSUPP;

			ret = af9035_wr_regs(d, reg, &msg[0].buf[3], msg[0].len - 3);

		} else {

			/* I2C write */

			u8 buf[MAX_XFER_SIZE];
@@ -457,6 +463,7 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap, 
		ret = -EOPNOTSUPP;

	}



unlock:

	mutex_unlock(&d->i2c_mutex);



	if (ret < 0)