Commit 4ee1eb86 authored by Zhang Shurong's avatar Zhang Shurong Committed by sanglipeng
Browse files

media: af9005: Fix null-ptr-deref in af9005_i2c_xfer 

stable inclusion
from stable-v5.10.197
commit c7e5ac737db25d7387fe517cb5207706782b6cf8
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I96Q8P

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c7e5ac737db25d7387fe517cb5207706782b6cf8



--------------------------------

[ Upstream commit f4ee84f2 ]

In af9005_i2c_xfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach af9005_i2c_xfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.

Similar commit:
commit 0ed554fd
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")

Signed-off-by: default avatarZhang Shurong <zhang_shurong@foxmail.com>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarsanglipeng <sanglipeng1@jd.com>
parent 88c9dca4

drivers/media/usb/dvb-usb/af9005.c

+5 −0
Original line number Diff line number Diff line
@@ -422,6 +422,10 @@ static int af9005_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], 
		if (ret == 0)

			ret = 2;

	} else {

		if (msg[0].len < 2) {

			ret = -EOPNOTSUPP;

			goto unlock;

		}

		/* write one or more registers */

		reg = msg[0].buf[0];

		addr = msg[0].addr;
@@ -431,6 +435,7 @@ static int af9005_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], 
			ret = 1;

	}



unlock:

	mutex_unlock(&d->i2c_mutex);

	return ret;

}